New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The poll page is visible to the users who is disallowed to show the related issue #5

Closed

cat-in-136 opened this issue Mar 28, 2016 · 1 comment

Owner

cat-in-136 commented Mar 28, 2016

How to reproduce:

Create the poll page to the issue "X"
Make the issue "X" invisible to user "Y" (e.g. make the issue "X" private)
Log on as user "Y", and then directly connect to /scheduling_poll/XXX

Expected: the poll page is also invisible.

Owner Author

cat-in-136 commented Mar 28, 2016

Adding raise ::Unauthorized unless @poll.issue.visible? to scheduling_polls_controller#set_scheduling_poll is good.

But this change breaks many test cases of this plugin (i.e. the original test cases are not correct and shall be fixed).

cat-in-136 added a commit that referenced this issue


          fix issue #5 : The poll page is visible to the users who is disallowe…

88d0adc

…d to show the related issue

cat-in-136 closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment