Merged r11518 from trunk (#8529).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/2.3-stable@11570 e93f8b46-1217-0410-a6f0-8f06a7374b81

test/integration/api_test/users_test.rb

@@ -108,6 +108,18 @@ class Redmine::ApiTest::UsersTest < Redmine::ApiTest::Base
     assert_tag 'user', :child => {:tag => 'login', :content => 'jsmith'}
   end
 
+  test "GET /users/:id should not return api_key for other user" do
+    get '/users/3.xml', {}, credentials('jsmith')
+    assert_response :success
+    assert_no_tag 'user', :child => {:tag => 'api_key'}
+  end
+
+  test "GET /users/:id should return api_key for current user" do
+    get '/users/2.xml', {}, credentials('jsmith')
+    assert_response :success
+    assert_tag 'user', :child => {:tag => 'api_key', :content => User.find(2).api_key}
+  end
+
   context "POST /users" do
     context "with valid parameters" do
       setup do