60 Commits

Author SHA1 Message Date
Jan Sandbrink f9d8bc6614 Introduce SubclassResponsibility error
This error is intended for cases when a method is
intentionally not implemented, because the module/class defining
it expects a subclass (or class including the module) to implement
the method.

This is intended to distinguish it from other cases, such as:
* feature not implemented yet
* edge case of a method call not yet supported

Notably it avoids the misuse of the Ruby-defined NotImplementedError,
which is only intended for much more specific scenarios:

> Raised when a feature is not implemented on the current platform. For example, methods depending on the fsync or fork system calls may raise this exception [...]

Also see https://docs.ruby-lang.org/en/master/NotImplementedError.html
2026-03-27 08:14:56 +01:00
ulferts 1096e71cd8 global query deletion of own queries simplified 2026-02-25 13:14:22 +01:00
Alexander Brandon Coles cdcba34230 Freeze string literals in app/policies
rubocop -A --only Style/FrozenStringLiteralComment,Layout/EmptyLineAfterMagicComment,Style/RedundantFreeze app/policies
2025-07-18 17:46:50 +01:00
ulferts e904e530d8 remove WorkPackagePolicy 2025-04-14 16:16:48 +02:00
Ivan Kuchin 4911b8a149 remove years from copyrights (except for COPYRIGHT file) 2024-07-31 15:02:49 +02:00
ulferts 3b2121f733 Revert "Merge remote-tracking branch 'origin/release/13.4' into dev"
This reverts commit 40b2bbeb09, reversing
changes made to b4c6cb17cc.
2024-03-21 11:31:17 +01:00
Ivan Kuchin 7787e457a3 Revert "Merge branch 'dev' into release/13.4"
This reverts commit a901541269, reversing
changes made to e573ca00b7.
2024-03-20 20:19:08 +01:00
Ivan Kuchin 9e4934cd0a change quotes using rubocop --only Style/StringLiterals,Style/QuotedSymbols -a 2024-03-20 18:05:22 +01:00
Richard "Virgo" Richter f30a43da7a Feature 50849, :edit_work_packages now allows change status as before.
:change_work_package_status permission is additive, but not disjunct
with :edit_work_packages - this means:
- no DB migration is needed, :edit_work_packages will work as before
- :change_work_package_status added to some tests was removed again
2024-01-08 12:12:14 +00:00
Richard "Virgo" Richter 9a530b6e0f Merge branch 'dev' into feature/50849_change_work_packages_status
# Conflicts:
#	spec/requests/api/v3/work_packages/update_resource_spec.rb
2024-01-08 08:39:36 +00:00
Christophe Bliard c795874f7f Update copyright year for 2024
command used: `rg -l 'Copyright \(C\) 2012-202\d the OpenProject' | xargs -n 100 sed -i -r 's/Copyright \(C\) 2012-202. the OpenProject/Copyright (C) 2012-2024 the OpenProject/'`
2024-01-02 16:23:54 +01:00
Richard "Virgo" Richter 2199801a7e Merge branch 'dev' into feature/50849_change_work_packages_status 2023-12-19 10:14:24 +00:00
Klaus Zanders 3cb23dc935 Simplify cache ure in WP Policy 2023-12-07 10:43:06 +01:00
Richard "Virgo" Richter f8e307a7a0 Merge branch 'dev' into feature/50849_change_work_packages_status
# Conflicts:
#	lib/api/v3/work_packages/work_package_representer.rb
2023-11-28 09:16:09 +00:00
Klaus Zanders 9f40df2b0e Check :edit_work_packages permission on the work package 2023-11-27 10:23:13 +01:00
Klaus Zanders 7d9f0cd3ef Remove caches from policies and use correct perm checks 2023-11-27 10:22:53 +01:00
Klaus Zanders 7394fa0f7a WorkPackagePolicy checks permission on work package 2023-11-27 10:22:47 +01:00
Richard "Virgo" Richter 3bb2eb0401 Feature 50849, added separate permission change_work_package_status
Permission `change_work_package_status` is similar to `assign_versions`
permission as it:
- Allows edit for status field, without the need for edit WP.
- Now `edit_work_packages` alone does not allow status edit; this is
how `assign_versions` works too, migration adding the new permission
to existing roles with edit WP is provided.

Some tests were fixed, but more fixes and some new tests will be added.
2023-11-07 11:49:35 +00:00
Klaus Zanders a15ee1eedb Replace checks for allowed_to in the policies 2023-10-26 08:49:44 +02:00
Jonas Jabari 1abf957c78 fixed rubocop issues outside of the calendar module introduced while working on this PR 2023-03-17 16:01:29 +08:00
Jonas Jabari 3267ac1a35 refactoring, bugfixing based on feedback, added first UI specs 2023-03-07 13:21:51 +08:00
Jonas Jabari f3d3bc3a5f moved ical sharing UI to calendar detail page (angular scope) as requested in specification 2023-02-23 14:35:10 +08:00
Christophe Bliard 21a696ef9b Update copyright information for 2023 2022-12-30 15:51:26 +01:00
ulferts e25d2f14ee cleanup policy (methods) no longer used 2022-07-11 08:53:05 +02:00
Christophe Bliard bc8d423ec2 update copyright information for 2022 2022-03-01 17:05:59 +01:00
ulferts 0fe90c21a7 rework hidden/starred of queries
The MenuItems::QueryMenuItems class used to map the `starred` state is replaced by a simple boolean flag. The hidden flag is removed (but still readable) as the concept of `View`s completely replaces it.
2021-12-10 17:37:45 +01:00
Oliver Günther ccfa29c728 Move license and copyright docs to root, fix names and references 2021-09-02 21:50:46 +02:00
ulferts 1bdd2ab9ae safe automatic fixes by rubocop (#8994) 2021-02-11 16:02:18 +01:00
ulferts 6140f4c7e9 update copyright to 2021 (#8925)
Updates the copyright to 2021 for all files that have a copyright. Files in our source code without the copyright header still do not receive one automatically. Additionally, backlisted files are also excluded.

Previously the copyright of chiliproject which references redmine stated a copyright of redmine up to and including 2017 which is not true for the code we have in here. Because of that I changed that to 2013
2021-01-13 17:47:45 +01:00
ulferts 6af7401704 fix ruby 2.7 deprecations (#8866) 2020-12-03 22:32:48 +01:00
ulferts 9e2287bfcc rename and inflect according to zeitwerk 2020-02-21 20:47:24 +01:00
Henriette Dinger bd7f4e4814 Update copyright notice 2020-01-15 11:31:26 +01:00
ulferts a5defb73c5 add dedicated permission to regulate assigning a version 2019-05-31 20:36:33 +02:00
Oliver Günther bc06da3a00 [30231] Allow users edit_work_packages permission to save query
https://community.openproject.com/wp/30231
2019-05-22 11:56:49 +02:00
Jens Ulferts 395c665627 do not allow edit when user only has comment permission 2018-08-21 09:34:37 +02:00
Jens Ulferts 24bcf147f2 lift project restriction from children table 2018-07-17 12:46:30 +02:00
Oliver Günther 1ffeedbd5d [27606] Allow inline-create in embedded children tables
https://community.openproject.com/wp/27606
2018-05-15 13:30:58 +02:00
Oliver Günther 78c363951a Merge remote-tracking branch 'origin/release/7.4' into dev 2018-05-07 11:11:33 +02:00
Oliver Günther d591e8ae4c [27600] Add link to query_form to represent allowing new queries to be saved (#6293)
When an existing query (and its form) is loaded, members with
permissions to create new queries, but NOT to update existing ones can
not save existing queries as new ones.

This is due to the `create`, `update` and `commit` (on form) links are
dependent on the query resource itself, not on general permissions of
the queries project.

https://community.openproject.com/wp/27600

[ci skip]
2018-05-03 15:45:05 +02:00
Oliver Günther 6ef4211e77 Bump copyright to 2018 (#6171)
[ci skip]
2018-02-12 08:51:12 +01:00
Jens Ulferts 6d43f1718e remove experimental api 2017-04-03 16:17:35 +02:00
Oliver Günther 7cf11bb689 Update copyright notice 2017-01-10 15:11:43 +01:00
Jens Ulferts 34b26a4ff4 add service specific for adding notes to a work package 2016-03-23 09:33:00 +01:00
Jens Ulferts da7b1d1c40 define project changing behavior in wp contract 2016-03-23 08:51:34 +01:00
Jan Sandbrink ca1616ae90 Merge remote-tracking branch 'upstream/release/4.2' into dev
Conflicts:
	Gemfile.lock
2015-09-17 11:35:29 +02:00
Oliver Günther a6b4372b09 Always preprocess URLs with CGI.unescape
This forces redirect URLs to always pass through the escaping process,
in order to process escaped paths (`/mysubdir/%2E%2E/secret/`).
2015-09-17 10:10:50 +02:00
Oliver Günther fcd450af3f Fix redirect vulnerability
`redirect_back_or_default` was vulnerable to some of the URLs found to
be vulnerable in redmine, such as `@test.foo`.

This commit extracts the whole functionality into a policy and alters
the constraints with a path check to avoid these cases.
Thanks to @marutosi for pointing this out.

http://www.redmine.org/projects/redmine/repository/revisions/14560
2015-09-15 09:30:31 +02:00
Oliver Günther b8c210e983 Resolve LoadError for scm policy 2015-08-19 14:45:15 +02:00
Oliver Günther 14a394842d Extract SCM authorization routines into policies per vendor 2015-08-19 10:13:18 +02:00
Alex Coles 29d9814347 Prefer Project.allowed_to to .allowed_to_condition
Use `ActiveRecord::Relation#merge` to merge scopes.

Signed-off-by: Alex Coles <alex@alexbcoles.com>
2015-07-11 12:24:22 +02:00