From 65c9223fe5554c147e50050308ab60510ce1c40c Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sat, 29 Mar 2014 14:37:17 +0000
Subject: [PATCH] Merged r12990 (#16338).

git-svn-id: http://svn.redmine.org/redmine/branches/2.5-stable@13022 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/models/time_entry.rb                   | 10 ++++++++++
 test/functional/timelog_controller_test.rb | 22 ++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb
index 5c1c7b67a..cfca47639 100644
--- a/app/models/time_entry.rb
+++ b/app/models/time_entry.rb
@@ -77,6 +77,16 @@ class TimeEntry < ActiveRecord::Base
     end
   end
 
+  def safe_attributes=(attrs, user=User.current)
+    attrs = super
+    if !new_record? && issue && issue.project_id != project_id
+      if user.allowed_to?(:log_time, issue.project)
+        self.project_id = issue.project_id
+      end
+    end
+    attrs
+  end
+
   def set_project_if_nil
     self.project = issue.project if issue && project.nil?
   end
diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb
index 376faf3ae..a64775039 100644
--- a/test/functional/timelog_controller_test.rb
+++ b/test/functional/timelog_controller_test.rb
@@ -289,6 +289,28 @@ class TimelogControllerTest < ActionController::TestCase
     assert_equal 2, entry.user_id
   end
 
+  def test_update_should_allow_to_change_issue_to_another_project
+    entry = TimeEntry.generate!(:issue_id => 1)
+
+    @request.session[:user_id] = 1
+    put :update, :id => entry.id, :time_entry => {:issue_id => '5'}
+    assert_response 302
+    entry.reload
+
+    assert_equal 5, entry.issue_id
+    assert_equal 3, entry.project_id
+  end
+
+  def test_update_should_not_allow_to_change_issue_to_an_invalid_project
+    entry = TimeEntry.generate!(:issue_id => 1)
+    Project.find(3).disable_module!(:time_tracking)
+
+    @request.session[:user_id] = 1
+    put :update, :id => entry.id, :time_entry => {:issue_id => '5'}
+    assert_response 200
+    assert_include "Issue is invalid", assigns(:time_entry).errors.full_messages
+  end
+
   def test_get_bulk_edit
     @request.session[:user_id] = 2
     get :bulk_edit, :ids => [1, 2]