diff --git a/app/controllers/cost_reports_controller.rb b/app/controllers/cost_reports_controller.rb index c3c09e72e9..08b0743db2 100644 --- a/app/controllers/cost_reports_controller.rb +++ b/app/controllers/cost_reports_controller.rb @@ -68,8 +68,10 @@ class CostReportsController < ApplicationController end private + ## FIXME: Remove this once we moved to Redmine 1.0 def find_optional_project @project = Project.find(params[:project_id]) unless params[:project_id].blank? + allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true) allowed ? true : deny_access rescue ActiveRecord::RecordNotFound