Develop v3.5.1

init.rb

@@ -3,7 +3,7 @@
  name 'View Customize plugin'
  author 'onozaty'
  description 'View Customize plugin for Redmine'
- version '3.5.0'
+ version '3.5.1'
  url 'https://github.com/onozaty/redmine-view-customize'
  author_url 'https://github.com/onozaty'
 

lib/redmine_view_customize/view_hook.rb

@@ -141,7 +141,8 @@ def create_view_customize_context(view_hook_context)
  "identifier" => project.identifier,
  "name" => project.name,
  "roles" => user.roles_for_project(project).map {|role| { "id" => role.id, "name" => role.name }},
- "customFields" => project.custom_field_values.map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }}
+ # Only include custom field values which are visible to the current user
+ "customFields" => project.visible_custom_field_values().map {|field| { "id" => field.custom_field.id, "name" => field.custom_field.name, "value" => field.value }}
  }
  end
 

test/unit/view_customize_view_hook_test.rb

@@ -97,6 +97,23 @@ def test_view_layouts_base_html_head
 
  end
 
+ def test_project_custom_field_visible
+
+ User.current = User.find(2)
+
+ # Change project custom filed visible
+ custom_field = CustomField.find(3)
+ custom_field.visible = false
+ custom_field.role_ids = [3]
+ custom_field.save()
+
+ expected = Regexp.escape("project\":{\"id\":1,\"identifier\":\"ecookbook\",\"name\":\"eCookbook\",\"roles\":[{\"id\":1,\"name\":\"Manager\"}],\"customFields\":[]}")
+
+ html = @hook.view_layouts_base_html_head({:request => Request.new("/issues"), :project => @project_ecookbook})
+ assert_match Regexp.new(expected), html
+
+ end
+
  def test_view_layouts_base_html_head_xss
 
  User.current = User.find(1)