Merge pull request #1967 from 0xF013/feature/15886-permission-to-manage-public-queries-not-respected

fix permission to manage public queries not respected

app/assets/javascripts/angular/work_packages/directives/options-dropdown-directive.js

@@ -94,7 +94,9 @@ angular.module('openproject.workPackages.directives')
       };
 
       scope.showShareModal = function(event){
-        showExistingQueryModal.call(shareModal, event);
+        if (allowQueryAction(event, 'publicize') || allowQueryAction(event, 'star')) {
+          showExistingQueryModal.call(shareModal, event);
+        }
       }
 
       scope.showSettingsModal = function(event){

karma/tests/directives/work_packages/options-dropdown-directive-test.js

@@ -97,6 +97,27 @@ describe('optionsDropdown Directive', function() {
           expect(saveAsLink.hasClass('inactive')).to.be.ok;
         });
 
+        context('share option', function() {
+          beforeEach(function() {
+            optionsDropdownHtml = '<div options-dropdown><a class="publicize-or-star-link" href ng-click="showShareModal($event)" ng-class="{\'inactive\': (cannot(\'query\', \'publicize\') && cannot(\'query\', \'star\'))}"></a></div>';
+            var query = new Query({
+              id: 1
+            });
+            scope.query = query;
+            AuthorisationService.initModelAuth('query', {
+              create: '/queries'
+            })
+            element = angular.element(optionsDropdownHtml);
+            compile();
+          });
+
+          it('should check with AuthorisationService when called', function() {
+            var shareLink = element.find('.publicize-or-star-link').first();
+            sinon.spy(AuthorisationService, "can");
+            shareLink.click();
+            expect(AuthorisationService.can).to.have.been.called;
+          });
+        })
         it('should not open save as modal', function() {
           var saveAsLink = element.find('a').first();
           saveAsLink.click();

public/templates/work_packages.list.html

@@ -103,7 +103,7 @@
     <li><a href ng-click="deleteQuery($event)" ng-class="{'inactive': cannot('query', 'delete')}">
       <i class="icon-action-menu icon-delete"></i>{{ I18n.t('js.toolbar.settings.delete') }}</a>
     </li>
-    <li><a href ng-click="showExportModal()" ng-class="{'inactive': cannot('work_package', 'export')}">
+    <li><a href ng-click="showExportModal($event)" ng-class="{'inactive': cannot('work_package', 'export')}">
       <i class="icon-action-menu icon-export"></i>{{ I18n.t('js.toolbar.settings.export') }}</a>
     </li>
     <li><a href ng-click="showShareModal($event)" ng-class="{'inactive': (cannot('query', 'publicize') && cannot('query', 'star'))}">