I believe I have tracked down the problem.

Context menu _Copy_ calls the @bulk_edit@ function in *issues_controller.rb*:
# checks if user has _move issue_ rights
# builds an allowed projects list by calling @allowed_target_projects_on_move@ in *issue.rb*:
# which checks projects for _move_ rights, not _add_ rights...

So for copy, the program checks for move-out and move-in rights. But move-in rights is really add rights.

I think instead, _move_ rights should be checked at source project and then _add_ rights at destination project. This should block a user from copying issues into a project where they do not have _add issue_ rights.

h4. issues_controller.rb snippet
<pre><code class="ruby">
# Bulk edit/copy a set of issues
def bulk_edit
@issues.sort!
@copy = params[:copy].present?
@notes = params[:notes]

if User.current.allowed_to?(:move_issues, @projects) # <----------- this is correct: can user move/copy in the first place
@allowed_projects = Issue.allowed_target_projects_on_move # <-------- i think this is wrong: target projects should only be add rights
if params[:issue]
@target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id].to_s}
if @target_project
target_projects = [@target_project]
end
end
end
target_projects ||= @projects
</code></pre>

--------------------------------------------------------------------------------
I made a small patch and destination projects are now only ones with _Add issue_ rights.

Unresolved: If the user does not change the project pull down from _(No change)_, then new issues will still be created even when the permissions should not allow it. This is past my knowledge point now.

# Modify models\issue.rb file:
<pre><code class="ruby">
# Returns a scope of projects that user can move issues to
def self.allowed_target_projects_on_move(user=User.current)
Project.where(Project.allowed_to_condition(user, :move_issues))
end

# Returns a scope of projects that user can add issues to # <--- new
def self.allowed_target_projects_on_copy(user=User.current) # <--- new
Project.where(Project.allowed_to_condition(user, :add_issues)) # <--- new
end # <--- new
</code></pre>
# Modify controllers\issues_controller.rb file:
<pre><code class="ruby">
# Bulk edit/copy a set of issues
def bulk_edit
@issues.sort!
@copy = params[:copy].present?
@notes = params[:notes]

if User.current.allowed_to?(:move_issues, @projects)
#@allowed_projects = Issue.allowed_target_projects_on_move # <---- comment out
@allowed_projects = Issue.allowed_target_projects_on_copy # <---- new line
if params[:issue]
@target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id].to_s}
if @target_project
target_projects = [@target_project]
end
end
end
target_projects ||= @projects
</code></pre>
--------------------------------------------------------------------------------
This is now fixed. The :move_issues permission is removed (r13981) and replaced with a :copy_issues permissionn (r13985). When allowed to copy issues, use can copy them to projects on which he has the :add_issues permission.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------

relates,Closed,28311,Remove unused i18n key "permission_move_issues"