Merge pull request #71 from oliverguenther/fix/hide_menu_item_anonymous

Hide cost reports from anonymous users when authentication is required

lib/open_project/reporting/engine.rb

@@ -48,11 +48,13 @@ module OpenProject::Reporting
       menu :top_menu, :cost_reports_global, {controller: '/cost_reports', action: 'index', project_id: nil},
         caption: :cost_reports_title,
         if: Proc.new {
-          ( User.current.allowed_to?(:view_time_entries, nil, global: true) ||
-            User.current.allowed_to?(:view_own_time_entries, nil, global: true) ||
-            User.current.allowed_to?(:view_cost_entries, nil, global: true) ||
-            User.current.allowed_to?(:view_own_cost_entries, nil, global: true)
-          )
+          (User.current.logged? || !Setting.login_required?) &&
+            (
+              User.current.allowed_to?(:view_time_entries, nil, global: true) ||
+              User.current.allowed_to?(:view_own_time_entries, nil, global: true) ||
+              User.current.allowed_to?(:view_cost_entries, nil, global: true) ||
+              User.current.allowed_to?(:view_own_cost_entries, nil, global: true)
+            )
         }
 
       menu :project_menu, :cost_reports,