Fix permission problem

.gitignore

@@ -0,0 +1 @@
+.history

Gemfile

@@ -0,0 +1,3 @@
+group :test do
+  gem 'rails-controller-testing'
+end

app/controllers/pivottables_controller.rb

@@ -1,9 +1,10 @@
 class PivottablesController < ApplicationController
   unloadable
-  if respond_to? :before_action
-    before_action :find_optional_project, :authorize, :only => [:index, :new, :save]
+  if respond_to?(:before_action)
+    before_action :find_project_by_project_id, :only => [:index, :new, :save]
+    before_action :authorize, :only => [:index]
   else
-    before_filter :find_optional_project, :authorize, :only => [:index, :new, :save]
+    before_filter :find_project_by_project_id, :authorize, :only => [:index, :new, :save]
   end
 
   helper :issues
@@ -19,7 +20,6 @@ def pivottables
   end
 
   def index
-    @project = Project.find(params[:project_id]) if params[:project_id]
     @language = current_language
     @language_js = "pivot." + current_language.to_s + ".js"
     @statuses = IssueStatus.sorted.collect{|s| [s.name] }
@@ -73,15 +73,7 @@ def index
     end
   end
 
-  def find_optional_project
-    # @project variable must be set before calling the authorize filter
-    return true unless params[:id]
-    @project = Project.find(params[:project_id])
-    #authorize
-  end
-
   def new
-    @project = Project.find(params[:project_id]) if params[:project_id]
     retrieve_query
     @query.project = @project
     @query.name = ""
@@ -94,7 +86,6 @@ def new
   end
 
   def save
-    @project = Project.find(params[:project_id]) if params[:project_id]
     retrieve_query
 
     @query.user = User.current
@@ -110,7 +101,6 @@ def save
       @query.visibility = IssueQuery::VISIBILITY_PRIVATE
     end
 
-
     config = params[:query][:options][:pivot_config]
     @query.options[:pivot_config] = { :table => config[:table],
                :rows => config[:rows],
@@ -130,10 +120,4 @@ def save
       render :action => 'new', :layout => !request.xhr?
     end
   end
-
-  def authorize
-    unless User.current.allowed_to?(:view_pivottables, nil, :global => true)
-      redirect_to signin_path
-    end
-  end
 end

test/functional/pivottables_controller_test.rb

@@ -30,54 +30,60 @@ def test_index_anonymous
     role = Role.anonymous
     role.add_permission! :view_pivottables
 
-    get :index, :project_id => 1
+    get :index, params: { :project_id => 1 }
     assert_response :success
 
-
     role.remove_permission! :view_pivottables
 
-    get :index, :project_id => 1
+    get :index, params: { :project_id => 1 }
     assert_response 302
   end
 
-
   def test_index_user
     role = Role.find(1)
     role.add_permission! :view_pivottables
 
-    get :index, :project_id => 1
+    get :index, params: { :project_id => 1 }
     assert_response :success
 
-
     role.remove_permission! :view_pivottables
     @request.session[:user_id] = 2
 
-    get :index, :project_id => 1
+    get :index, params: { :project_id => 1 }
     assert_response 403
   end
 
   def test_issues
-    get :index, :project_id => 1
+    get :index, params: { :project_id => 1 }
 
     assert assigns(:issues)
     assert_equal 4, assigns(:issues).length
   end
 
   def test_new
-    get :new, :project_id => 1
+    get :new, params: { :project_id => 1 }
     assert_response :success
 
     assert assigns[:query][:options][:pivot_config]
   end
 
   def test_save
     assert_difference 'Query.count' do
-      post :save, :project_id => 1, :query => {:name => "BarChart", :options => {
-         :pivot_config => { "table"=>"", "rows"=>"Target version,Assignee", "cols"=>"Status", "rendererName"=>"Bar Chart", "aggregatorName"=>"Count", "attrdropdown"=>"" }}}
-
-      q = Query.find_by_name('BarChart')
+      post :save, params: { :project_id => 1,
+                            :query => {
+                              :name => "BarChart", 
+                              :options => { 
+                                :pivot_config => { "table"=>"",
+                                                   "rows"=>"Target version,Assignee",
+                                                   "cols"=>"Status",
+                                                   "rendererName"=>"Bar Chart",
+                                                   "aggregatorName"=>"Count",
+                                                   "attrdropdown"=>"" }
+                              }
+                            }
+                          }
+      Query.find_by_name('BarChart')
       assert_redirected_to :controller => 'pivottables', :action => 'index', :project_id => 'ecookbook', :query_id => assigns(:query).id
     end
   end
-
 end