openproject/app/controllers/cost_reports_controller.rb

class CostReportsController < ApplicationController
  before_filter :find_optional_project, :only => [:index]

  private
  def find_optional_project
    @project = Project.find(params[:project_id]) unless params[:project_id].blank?
    allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
    allowed ? true : deny_access
  rescue ActiveRecord::RecordNotFound
    render_404
  end
end