Merge pull request #121 from onozaty/develop/v3.5.1

Develop v3.5.1

Author: onozaty

Diff for: init.rb

@@ -3,7 +3,7 @@
   name 'View Customize plugin'
   author 'onozaty'
   description 'View Customize plugin for Redmine'
-  version '3.5.0'
+  version '3.5.1'
   url 'https://github.com/onozaty/redmine-view-customize'
   author_url 'https://github.com/onozaty'
 

Diff for: lib/redmine_view_customize/view_hook.rb

@@ -141,7 +141,8 @@ def create_view_customize_context(view_hook_context)
           "identifier" => project.identifier,
           "name" => project.name,
           "roles" => user.roles_for_project(project).map {|role| { "id" => role.id, "name" => role.name }},
-          "customFields" => project.custom_field_values.map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }}
+          # Only include custom field values which are visible to the current user
+          "customFields" => project.visible_custom_field_values().map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }}
         }
       end
 

Diff for: test/unit/view_customize_view_hook_test.rb

@@ -97,6 +97,23 @@ def test_view_layouts_base_html_head
 
   end
 
+  def test_project_custom_field_visible
+
+    User.current = User.find(2)
+
+    # Change project custom filed visible
+    custom_field = CustomField.find(3)
+    custom_field.visible = false
+    custom_field.role_ids = [3]
+    custom_field.save()
+
+    expected = Regexp.escape("project\":{\"id\":1,\"identifier\":\"ecookbook\",\"name\":\"eCookbook\",\"roles\":[{\"id\":1,\"name\":\"Manager\"}],\"customFields\":[]}")
+
+    html = @hook.view_layouts_base_html_head({:request => Request.new("/issues"), :project => @project_ecookbook})
+    assert_match Regexp.new(expected), html
+
+  end
+
   def test_view_layouts_base_html_head_xss
 
     User.current = User.find(1)