stable

Clone or download

Read-only

Deny drop permission when user cannot see one team

part of request #23383 Bad request error when planning a feature How to test: Set up program management with at least one Team as a private project. Your current user: - must not be site administrator - must be member of the Program project - must not see the private project (not a project member) - must be in a user group allowed to plan features in Program Management admin When you browse the Program Management app and you try to drop a feature in a Program Increment, you should see a message "You are not allowed to plan in this program increment." Before this patch, you could drop the feature but you would get a bad request error. Notes: There are still outstanding issues. Even if you're part of the private Team, there are still some missing permission checks. Change-Id: Iac6047f76233bc3ff6f2bfe3e356a3284ebc34f8

Modified Files

Name
M plugins/program_management/include/Domain/Program/Backlog/ProgramIncrement/UserCanPlanInProgramIncrementVerifier.php +33 −2 Go to diff View file
M plugins/program_management/include/REST/v1/ProgramIncrementResource.php +39 −26 Go to diff View file
M plugins/program_management/include/REST/v1/ProjectResource.php +11 −2 Go to diff View file
M plugins/program_management/include/program_managementPlugin.php +25 −11 Go to diff View file
M plugins/program_management/tests/unit/Builder/UserCanPlanInProgramIncrementVerifierBuilder.php +7 −1 Go to diff View file
M plugins/program_management/tests/unit/Domain/Program/Backlog/ProgramIncrement/UserCanPlanInProgramIncrementVerifierTest.php +46 −6 Go to diff View file