diff --git a/app/components/work_package_relations_tab/add_work_package_child_form_component.rb b/app/components/work_package_relations_tab/add_work_package_child_form_component.rb
index f9f4d6863b11..8ad85664a9c8 100644
--- a/app/components/work_package_relations_tab/add_work_package_child_form_component.rb
+++ b/app/components/work_package_relations_tab/add_work_package_child_form_component.rb
@@ -47,6 +47,6 @@ def initialize(work_package:, base_errors: nil)
def submit_url_options
{ method: :post,
- url: work_package_children_path(@work_package) }
+ url: work_package_children_relations_path(@work_package) }
end
end
diff --git a/app/components/work_package_relations_tab/index_component.html.erb b/app/components/work_package_relations_tab/index_component.html.erb
index e78e21510bbf..c12694bc30e6 100644
--- a/app/components/work_package_relations_tab/index_component.html.erb
+++ b/app/components/work_package_relations_tab/index_component.html.erb
@@ -37,7 +37,7 @@
if should_render_add_child?
menu.with_item(
label: t("#{I18N_NAMESPACE}.relations.label_child_singular").capitalize,
- href: new_work_package_child_path(@work_package),
+ href: new_work_package_children_relation_path(@work_package),
test_selector: new_button_test_selector(relation_type: :child),
content_arguments: {
data: { turbo_stream: true }
diff --git a/app/components/work_package_relations_tab/index_component.rb b/app/components/work_package_relations_tab/index_component.rb
index 083455043601..f886f99da77f 100644
--- a/app/components/work_package_relations_tab/index_component.rb
+++ b/app/components/work_package_relations_tab/index_component.rb
@@ -27,6 +27,8 @@ def self.wrapper_key
private
def should_render_add_child?
+ return false if @work_package.milestone?
+
helpers.current_user.allowed_in_project?(:manage_subtasks, @work_package.project)
end
diff --git a/app/components/work_package_relations_tab/relation_component.rb b/app/components/work_package_relations_tab/relation_component.rb
index efed86f893f4..c3d210607bc2 100644
--- a/app/components/work_package_relations_tab/relation_component.rb
+++ b/app/components/work_package_relations_tab/relation_component.rb
@@ -85,7 +85,7 @@ def edit_path
def destroy_path
if parent_child_relationship?
- work_package_child_path(@work_package, @child)
+ work_package_children_relation_path(@work_package, @child)
else
work_package_relation_path(@work_package, @relation)
end
diff --git a/app/controllers/custom_fields_controller.rb b/app/controllers/custom_fields_controller.rb
index 2beb4cfd0ff5..c280ec2dfebb 100644
--- a/app/controllers/custom_fields_controller.rb
+++ b/app/controllers/custom_fields_controller.rb
@@ -30,14 +30,17 @@ class CustomFieldsController < ApplicationController
include CustomFields::SharedActions # share logic with ProjectCustomFieldsControlller
layout "admin"
+ # rubocop:disable Rails/LexicallyScopedActionFilter
before_action :require_admin
before_action :find_custom_field, only: %i(edit update destroy delete_option reorder_alphabetical)
before_action :prepare_custom_option_position, only: %i(update create)
before_action :find_custom_option, only: :delete_option
+ before_action :validate_enterprise_token, only: %i(create)
+ # rubocop:enable Rails/LexicallyScopedActionFilter
def index
# loading wp cfs exclicity to allow for eager loading
- @custom_fields_by_type = CustomField.all
+ @custom_fields_by_type = CustomField
.where.not(type: ["WorkPackageCustomField", "ProjectCustomField"])
.group_by { |f| f.class.name }
@@ -64,6 +67,12 @@ def show_local_breadcrumb
false
end
+ def validate_enterprise_token
+ if params.dig(:custom_field, :field_format) == "hierarchy" && !EnterpriseToken.allows_to?(:custom_field_hierarchies)
+ render_403
+ end
+ end
+
def find_custom_field
@custom_field = CustomField.find(params[:id])
rescue ActiveRecord::RecordNotFound
diff --git a/app/controllers/work_package_children_controller.rb b/app/controllers/work_package_children_relations_controller.rb
similarity index 65%
rename from app/controllers/work_package_children_controller.rb
rename to app/controllers/work_package_children_relations_controller.rb
index 2c95e3cc8a39..2f1fb1574e5f 100644
--- a/app/controllers/work_package_children_controller.rb
+++ b/app/controllers/work_package_children_relations_controller.rb
@@ -28,7 +28,7 @@
# See COPYRIGHT and LICENSE files for more details.
#++
-class WorkPackageChildrenController < ApplicationController
+class WorkPackageChildrenRelationsController < ApplicationController
include OpTurbo::ComponentStream
include OpTurbo::DialogStreamHelper
@@ -36,9 +36,6 @@ class WorkPackageChildrenController < ApplicationController
before_action :authorize # Short-circuit early if not authorized
- before_action :set_child, except: %i[new create]
- before_action :set_relations, except: %i[new create]
-
def new
component = WorkPackageRelationsTab::AddWorkPackageChildDialogComponent
.new(work_package: @work_package)
@@ -46,38 +43,33 @@ def new
end
def create
- target_work_package_id = params[:work_package][:id]
- target_child_work_package = WorkPackage.find(target_work_package_id)
+ child = WorkPackage.find(params[:work_package][:id])
+ service_result = set_relation(child:, parent: @work_package)
- target_child_work_package.parent = @work_package
+ respond_with_relations_tab_update(service_result)
+ end
- if target_child_work_package.save
- @children = @work_package.children.visible
- @relations = @work_package.relations.visible
+ def destroy
+ child = WorkPackage.find(params[:id])
+ service_result = set_relation(child:, parent: nil)
- component = WorkPackageRelationsTab::IndexComponent.new(
- work_package: @work_package,
- relations: @relations,
- children: @children
- )
- replace_via_turbo_stream(component:)
- update_flash_message_via_turbo_stream(
- message: I18n.t(:notice_successful_update), scheme: :success
- )
- respond_with_turbo_streams
- end
+ respond_with_relations_tab_update(service_result)
end
- def destroy
- @child.parent = nil
+ private
- if @child.save
+ def set_relation(child:, parent:)
+ WorkPackages::UpdateService.new(user: current_user, model: child)
+ .call(parent:)
+ end
+
+ def respond_with_relations_tab_update(service_result)
+ if service_result.success?
@work_package.reload
- @children = @work_package.children.visible
component = WorkPackageRelationsTab::IndexComponent.new(
work_package: @work_package,
- relations: @relations,
- children: @children
+ relations: @work_package.relations.visible,
+ children: @work_package.children.visible
)
replace_via_turbo_stream(component:)
update_flash_message_via_turbo_stream(
@@ -85,21 +77,13 @@ def destroy
)
respond_with_turbo_streams
+ else
+ respond_with_turbo_streams(status: :unprocessable_entity)
end
end
- private
-
def set_work_package
@work_package = WorkPackage.find(params[:work_package_id])
@project = @work_package.project
end
-
- def set_child
- @child = WorkPackage.find(params[:id])
- end
-
- def set_relations
- @relations = @work_package.relations.visible
- end
end
diff --git a/app/controllers/work_package_relations_controller.rb b/app/controllers/work_package_relations_controller.rb
index 837e4e10a190..6be607a1669d 100644
--- a/app/controllers/work_package_relations_controller.rb
+++ b/app/controllers/work_package_relations_controller.rb
@@ -62,8 +62,8 @@ def create
if service_result.success?
@work_package.reload
component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
- relations: @work_package.relations,
- children: @work_package.children)
+ relations: @work_package.relations.visible,
+ children: @work_package.children.visible)
replace_via_turbo_stream(component:)
respond_with_turbo_streams
else
@@ -80,8 +80,8 @@ def update
if service_result.success?
@work_package.reload
component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
- relations: @work_package.relations,
- children: @work_package.children)
+ relations: @work_package.relations.visible,
+ children: @work_package.children.visible)
replace_via_turbo_stream(component:)
respond_with_turbo_streams
else
@@ -93,11 +93,12 @@ def destroy
service_result = Relations::DeleteService.new(user: current_user, model: @relation).call
if service_result.success?
- @children = WorkPackage.where(parent_id: @work_package.id)
+ @children = WorkPackage.where(parent_id: @work_package.id).visible
@relations = @work_package
.relations
.reload
.includes(:to, :from)
+ .visible
component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
relations: @relations,
diff --git a/app/controllers/work_package_relations_tab_controller.rb b/app/controllers/work_package_relations_tab_controller.rb
index c8d9ab9ad75b..f457a67fd936 100644
--- a/app/controllers/work_package_relations_tab_controller.rb
+++ b/app/controllers/work_package_relations_tab_controller.rb
@@ -33,9 +33,10 @@ class WorkPackageRelationsTabController < ApplicationController
before_action :authorize_global
def index
- @children = WorkPackage.where(parent_id: @work_package.id)
+ @children = WorkPackage.where(parent_id: @work_package.id).visible
@relations = @work_package
.relations
+ .visible
.includes(:to, :from)
component = WorkPackageRelationsTab::IndexComponent.new(
diff --git a/app/services/principals/replace_references_service.rb b/app/services/principals/replace_references_service.rb
index e1c0810a49c1..14d46adac922 100644
--- a/app/services/principals/replace_references_service.rb
+++ b/app/services/principals/replace_references_service.rb
@@ -43,6 +43,7 @@ def call(from:, to:)
def rewrite_active_models(from, to)
rewrite_author(from, to)
+ rewrite_creator(from, to)
rewrite_user(from, to)
rewrite_assigned_to(from, to)
rewrite_responsible(from, to)
@@ -92,6 +93,12 @@ def rewrite_author(from, to)
end
end
+ def rewrite_creator(from, to)
+ [AuthProvider].each do |klass|
+ rewrite(klass, :creator_id, from, to)
+ end
+ end
+
def rewrite_user(from, to)
[TimeEntry,
CostEntry,
@@ -149,7 +156,7 @@ def journal_classes
end
def foreign_keys
- %w[author_id user_id assigned_to_id responsible_id logged_by_id presenter_id]
+ %w[author_id creator_id user_id assigned_to_id responsible_id logged_by_id presenter_id]
end
def rewrite(klass, attribute, from, to)
diff --git a/app/views/wiki/export_multiple.html.erb b/app/views/wiki/export_multiple.html.erb
index 83462dae26a2..f7f3daa7f2f8 100644
--- a/app/views/wiki/export_multiple.html.erb
+++ b/app/views/wiki/export_multiple.html.erb
@@ -53,7 +53,7 @@ See COPYRIGHT and LICENSE files for more details.
<% @pages.each do |page| %>
- <%= format_text page.content ,:text, wiki_links: :anchor %>
+ <%= format_text page ,:text, wiki_links: :anchor %>
<% end %>