Vote #79812
完了"View differences" buttons are shown in the repository page even without "Browse repository" permission
0%
説明
You are not allowed to see the diff between changesets if you don't have a "Browse repository" permission. However, "View differences" buttons on RepositoriesController#show page are always shown even if you don't have the permission. In contrast, the "View differences" tab on the RepositoriesController#revision is hidden depending on the permission.
I think the buttons should be hidden if the current user does not have a "Browse repository" permission.
!{width: 519px; border: 1px solid #ccc;}.view-diff-button@2x.png!
journals
It seems to be able to solve this problem by adding the following condition for disp the button.
<pre><code class="ruby">
User.current.allowed_to?(:browse_repository, @repository.project)
</code></pre>
I made a patch and attached it.
--------------------------------------------------------------------------------
Thank you for the patch. While reviewing the patch, I found that we don't have to show radio buttons to select revisions to show diff when "View differences" is hidden.
IMHO, the following fix is better. It hides the radio boxes as well as the button. In addition, it is simpler.
<pre><code class="diff">
diff --git a/app/views/repositories/_revisions.html.erb b/app/views/repositories/_revisions.html.erb
index 914999b34..514380791 100644
--- a/app/views/repositories/_revisions.html.erb
+++ b/app/views/repositories/_revisions.html.erb
@@ -20,7 +20,7 @@ end %>
:repository_id => @repository.identifier_param, :path => to_path_param(path)},
:method => :get
) do %>
-<% show_diff = revisions.size > 1 %>
+<% show_diff = revisions.size > 1 && User.current.allowed_to?(:browse_repository, @repository.project) %>
<%= submit_tag(l(:label_view_diff), :name => nil) if show_diff %>
<table class="list changesets">
<thead><tr>
</code></pre>
--------------------------------------------------------------------------------
Right, As you said the radio button should also be hidden.
I also thought that the proposed patch is simpler and better.
--------------------------------------------------------------------------------
Setting the target version to 4.0.3.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Committed, thanks.
--------------------------------------------------------------------------------