diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb index 5c1c7b67a..cfca47639 100644 --- a/app/models/time_entry.rb +++ b/app/models/time_entry.rb @@ -77,6 +77,16 @@ class TimeEntry < ActiveRecord::Base end end + def safe_attributes=(attrs, user=User.current) + attrs = super + if !new_record? && issue && issue.project_id != project_id + if user.allowed_to?(:log_time, issue.project) + self.project_id = issue.project_id + end + end + attrs + end + def set_project_if_nil self.project = issue.project if issue && project.nil? end diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb index 376faf3ae..a64775039 100644 --- a/test/functional/timelog_controller_test.rb +++ b/test/functional/timelog_controller_test.rb @@ -289,6 +289,28 @@ class TimelogControllerTest < ActionController::TestCase assert_equal 2, entry.user_id end + def test_update_should_allow_to_change_issue_to_another_project + entry = TimeEntry.generate!(:issue_id => 1) + + @request.session[:user_id] = 1 + put :update, :id => entry.id, :time_entry => {:issue_id => '5'} + assert_response 302 + entry.reload + + assert_equal 5, entry.issue_id + assert_equal 3, entry.project_id + end + + def test_update_should_not_allow_to_change_issue_to_an_invalid_project + entry = TimeEntry.generate!(:issue_id => 1) + Project.find(3).disable_module!(:time_tracking) + + @request.session[:user_id] = 1 + put :update, :id => entry.id, :time_entry => {:issue_id => '5'} + assert_response 200 + assert_include "Issue is invalid", assigns(:time_entry).errors.full_messages + end + def test_get_bulk_edit @request.session[:user_id] = 2 get :bulk_edit, :ids => [1, 2]