Merge pull request #5418 from opf/fix/calendar_month_switch

Fix/calendar month switch

app/helpers/application_helper.rb

@@ -1,4 +1,5 @@
 #-- encoding: UTF-8
+
 #-- copyright
 # OpenProject is a project management system.
 # Copyright (C) 2012-2017 the OpenProject Foundation (OPF)
@@ -412,33 +413,6 @@ module ApplicationHelper
     end
   end
 
-  # this method seems to not be used any more
-  def page_header_title
-    if @page_header_title.present?
-      h(@page_header_title)
-    elsif @project.nil? || @project.new_record?
-      h(Setting.app_title)
-    else
-      b = []
-      ancestors = (@project.root? ? [] : @project.ancestors.visible)
-      if ancestors.any?
-        root = ancestors.shift
-        b << link_to_project(root, { jump: current_menu_item }, class: 'root')
-
-        if ancestors.size > 2
-          b << '&#8230;'
-          ancestors = ancestors[-2, 2]
-        end
-
-        b += ancestors.map { |p|
-          link_to_project(p, { jump: current_menu_item }, class: 'ancestor')
-        }
-      end
-      b << h(@project)
-      b.join(' &#187; ')
-    end
-  end
-
   def html_title(*args)
     title = []
 
@@ -695,6 +669,10 @@ module ApplicationHelper
     "#%02x%02x%02x" % rgb
   end
 
+  def permitted_params
+    PermittedParams.new(params, current_user)
+  end
+
   private
 
   def wiki_helper

app/helpers/calendars_helper.rb

@@ -1,4 +1,5 @@
 #-- encoding: UTF-8
+
 #-- copyright
 # OpenProject is a project management system.
 # Copyright (C) 2012-2017 the OpenProject Foundation (OPF)
@@ -59,6 +60,11 @@ module CalendarsHelper
   def link_to_month(date_to_show, options = {})
     date = date_to_show.to_date
     name = ::I18n.l date, format: options.delete(:display_year) ? '%B %Y' : '%B'
-    link_to_content_update(name, { year: date.year, month: date.month }, options)
+
+    merged_params = permitted_params
+                    .calendar_filter
+                    .merge(year: date.year, month: date.month)
+
+    link_to_content_update(name, merged_params, options)
   end
 end

app/models/permitted_params.rb

@@ -101,7 +101,8 @@ class PermittedParams
     params.permit(*self.class.permitted_attributes[:group_membership])
   end
 
-  def new_work_package(args = {})
+  def update_work_package(args = {})
+    # used to be called new_work_package with an alias to update_work_package
     permitted = permitted_attributes(:new_work_package, args)
 
     permitted_params = params.require(:work_package).permit(*permitted)
@@ -153,12 +154,26 @@ class PermittedParams
     # the sort_criteria hash itself (again with content) in the same hash.
     # Here we try to circumvent this
     p = params.require(:query).permit(*self.class.permitted_attributes[:query])
-    p[:sort_criteria] = params.require(:query)
+    p[:sort_criteria] = params
+                        .require(:query)
                         .permit(sort_criteria: { '0' => [], '1' => [], '2' => [] })
     p[:sort_criteria].delete :sort_criteria
     p
   end
 
+  def calendar_filter
+    keys =  Query.registered_filters.map(&:key)
+    op_keys = keys_whitelisted_by_list(params["op"], keys)
+    v_keys = keys_whitelisted_by_list(params["v"], keys).map { |f| { f => [] } }
+
+    params.permit(:project_id,
+                  :month,
+                  :year,
+                  f: [],
+                  op: op_keys,
+                  v: v_keys)
+  end
+
   def role
     params.require(:role).permit(*self.class.permitted_attributes[:role])
   end
@@ -171,8 +186,6 @@ class PermittedParams
     params.require(:status).permit(*self.class.permitted_attributes[:status])
   end
 
-  alias :update_work_package :new_work_package
-
   def user
     permitted_params = params.require(:user).permit(*self.class.permitted_attributes[:user])
     permitted_params = permitted_params.merge(custom_field_values(:user))
@@ -413,7 +426,7 @@ class PermittedParams
 
     # only permit values following the schema
     # 'id as string' => 'value as string'
-    values.reject! do |k, v| k.to_i < 1 || !v.is_a?(String) end
+    values.reject! { |k, v| k.to_i < 1 || !v.is_a?(String) }
 
     values.empty? ? {} : { 'custom_field_values' => values.permit! }
   end
@@ -660,4 +673,10 @@ class PermittedParams
       permitted_attributes[key] += attrs
     end
   end
+
+  def keys_whitelisted_by_list(hash, list)
+    (hash || {})
+      .keys
+      .select { |k| list.any? { |whitelisted| whitelisted.to_s == k.to_s || whitelisted === k } }
+  end
 end

app/views/work_packages/calendars/index.html.erb

@@ -58,8 +58,8 @@ See doc/COPYRIGHT.rdoc for more details.
 <%= error_messages_for 'query' %>
 <% if @query.valid? %>
   <p style="float:right;">
-    <%= link_to_previous_month(@year, @month, project: @project) %>
-    | <%= link_to_next_month(@year, @month, project: @project) %>
+    <%= link_to_previous_month(@year, @month, project: @query.project) %>
+    | <%= link_to_next_month(@year, @month, project: @query.project) %>
   </p>
   <%= render partial: 'common/calendar', locals: { calendar: @calendar } %>
   <p class="legend cal">