diff --git a/init.rb b/init.rb index 8214018..a7bcffa 100644 --- a/init.rb +++ b/init.rb @@ -3,7 +3,7 @@ name 'View Customize plugin' author 'onozaty' description 'View Customize plugin for Redmine' - version '3.5.0' + version '3.5.1' url 'https://github.com/onozaty/redmine-view-customize' author_url 'https://github.com/onozaty' diff --git a/lib/redmine_view_customize/view_hook.rb b/lib/redmine_view_customize/view_hook.rb index 15e7fda..5a6c02c 100644 --- a/lib/redmine_view_customize/view_hook.rb +++ b/lib/redmine_view_customize/view_hook.rb @@ -141,7 +141,8 @@ def create_view_customize_context(view_hook_context) "identifier" => project.identifier, "name" => project.name, "roles" => user.roles_for_project(project).map {|role| { "id" => role.id, "name" => role.name }}, - "customFields" => project.custom_field_values.map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }} + # Only include custom field values which are visible to the current user + "customFields" => project.visible_custom_field_values().map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }} } end diff --git a/test/unit/view_customize_view_hook_test.rb b/test/unit/view_customize_view_hook_test.rb index 096b1b2..7369d32 100644 --- a/test/unit/view_customize_view_hook_test.rb +++ b/test/unit/view_customize_view_hook_test.rb @@ -97,6 +97,23 @@ def test_view_layouts_base_html_head end + def test_project_custom_field_visible + + User.current = User.find(2) + + # Change project custom filed visible + custom_field = CustomField.find(3) + custom_field.visible = false + custom_field.role_ids = [3] + custom_field.save() + + expected = Regexp.escape("project\":{\"id\":1,\"identifier\":\"ecookbook\",\"name\":\"eCookbook\",\"roles\":[{\"id\":1,\"name\":\"Manager\"}],\"customFields\":[]}") + + html = @hook.view_layouts_base_html_head({:request => Request.new("/issues"), :project => @project_ecookbook}) + assert_match Regexp.new(expected), html + + end + def test_view_layouts_base_html_head_xss User.current = User.find(1)