26 Commits (8737e5c785ddef798da586c3b5d448dffe4fd566)

Author	SHA1	Message	Date
Jens Ulferts	395c665627	do not allow edit when user only has comment permission	6 years ago
Jens Ulferts	24bcf147f2	lift project restriction from children table	6 years ago
Oliver Günther	1ffeedbd5d	[27606] Allow inline-create in embedded children tables ... https://community.openproject.com/wp/27606	7 years ago
Oliver Günther	d591e8ae4c	[27600] Add link to query_form to represent allowing new queries to be saved (#6293) ... When an existing query (and its form) is loaded, members with permissions to create new queries, but NOT to update existing ones can not save existing queries as new ones. This is due to the `create`, `update` and `commit` (on form) links are dependent on the query resource itself, not on general permissions of the queries project. https://community.openproject.com/wp/27600 [ci skip]	7 years ago
Oliver Günther	6ef4211e77	Bump copyright to 2018 (#6171) ... [ci skip]	7 years ago
Jens Ulferts	6d43f1718e	remove experimental api	8 years ago
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Jens Ulferts	34b26a4ff4	add service specific for adding notes to a work package	9 years ago
Jens Ulferts	da7b1d1c40	define project changing behavior in wp contract	9 years ago
Oliver Günther	a6b4372b09	Always preprocess URLs with CGI.unescape ... This forces redirect URLs to always pass through the escaping process, in order to process escaped paths (`/mysubdir/%2E%2E/secret/`).	9 years ago
Oliver Günther	fcd450af3f	Fix redirect vulnerability ... `redirect_back_or_default` was vulnerable to some of the URLs found to be vulnerable in redmine, such as `@test.foo`. This commit extracts the whole functionality into a policy and alters the constraints with a path check to avoid these cases. Thanks to @marutosi for pointing this out. http://www.redmine.org/projects/redmine/repository/revisions/14560	9 years ago
Oliver Günther	b8c210e983	Resolve LoadError for scm policy	9 years ago
Oliver Günther	14a394842d	Extract SCM authorization routines into policies per vendor	9 years ago
Alex Coles	29d9814347	Prefer Project.allowed_to to .allowed_to_condition ... Use `ActiveRecord::Relation#merge` to merge scopes. Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Alex Coles	e0012a6e92	Fix syntax (w/Rubocop) in VersionPolicy ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Jens Ulferts	f05ec67eb3	use policy to calculate version link existence	10 years ago
Alex Coles	e0191e759c	Update year in copyright header to 2015 ... [ci skip]	10 years ago
Alex Coles	4c6623e0ae	Fix syntax (w/Rubocop) in policies ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Hagen Schink	f3ebc8c37b	Check manage subtasks permission on child's project	10 years ago
Hagen Schink	d26d1502b4	Move WP manage subtask authorization to model	10 years ago
Philipp Tessenow	8237010d31	add 'show' action to QueryPolicy	10 years ago
Hagen Schink	ef039b32ec	Correct query deletion verb on server side	10 years ago
Jens Ulferts	f7d92b156e	fixes permission links on query	10 years ago
Jens Ulferts	4817547d4a	introduces policies ... The pattern used here is taken from pundit although this here does by far not have the functionality pundit offers.	10 years ago