From 7efed5b277c675af812cdb57cb07cfde98364b00 Mon Sep 17 00:00:00 2001
From: ulferts <jens.ulferts@googlemail.com>
Date: Wed, 4 Dec 2024 14:06:12 +0100
Subject: [PATCH] limit select for user cf value options

---
 app/models/custom_field.rb                     | 15 +++++++++------
 spec/lib/custom_field_form_builder_spec.rb     |  9 +++++++--
 .../actions/custom_field_spec.rb               | 18 ++++++++++++++----
 spec/models/custom_field_spec.rb               | 14 ++++++++++++--
 4 files changed, 42 insertions(+), 14 deletions(-)

diff --git a/app/models/custom_field.rb b/app/models/custom_field.rb
index 9fc37427bde9..ca359cf91966 100644
--- a/app/models/custom_field.rb
+++ b/app/models/custom_field.rb
@@ -326,12 +326,15 @@ def possible_version_values_options(obj)
 
   def possible_user_values_options(obj)
     mapped_with_deduced_project(obj) do |project|
-      if project&.persisted?
-        project.principals
-      else
-        Principal
-          .in_visible_project_or_me(User.current)
-      end
+      scope = if project&.persisted?
+                project.principals
+              else
+                Principal
+                  .in_visible_project_or_me(User.current)
+              end
+
+      scope
+        .select(*(User::USER_FORMATS_STRUCTURE[Setting.user_format].map(&:to_s) << "id"))
     end
   end
 
diff --git a/spec/lib/custom_field_form_builder_spec.rb b/spec/lib/custom_field_form_builder_spec.rb
index 00820ae90378..06337c5ed128 100644
--- a/spec/lib/custom_field_form_builder_spec.rb
+++ b/spec/lib/custom_field_form_builder_spec.rb
@@ -255,6 +255,7 @@
       let(:project) { build_stubbed(:project) }
       let(:user1) { build_stubbed(:user) }
       let(:user2) { build_stubbed(:user) }
+      let(:scope) { instance_double(ActiveRecord::Relation) }
 
       let(:resource) { project }
 
@@ -268,8 +269,12 @@
         end
 
         allow(project)
-          .to(receive(:principals))
-          .and_return([user1, user2])
+          .to receive(:principals)
+                .and_return(scope)
+
+        allow(scope)
+          .to receive(:select)
+                .and_return([user1, user2])
       end
 
       it_behaves_like "wrapped in container", "select-container" do
diff --git a/spec/models/custom_actions/actions/custom_field_spec.rb b/spec/models/custom_actions/actions/custom_field_spec.rb
index 05c68c594384..afc2c54b1f00 100644
--- a/spec/models/custom_actions/actions/custom_field_spec.rb
+++ b/spec/models/custom_actions/actions/custom_field_spec.rb
@@ -441,12 +441,17 @@
          build_stubbed(:user),
          build_stubbed(:user)]
       end
+      let(:scope) { instance_double(ActiveRecord::Relation) }
 
       before do
         allow(Principal)
           .to receive(:in_visible_project_or_me)
-          .with(User.current)
-          .and_return(users)
+                .with(User.current)
+                .and_return(scope)
+
+        allow(scope)
+          .to receive(:select)
+                .and_return(users)
       end
 
       context "for a non required field" do
@@ -515,12 +520,17 @@
          build_stubbed(:user),
          build_stubbed(:user)]
       end
+      let(:scope) { instance_double(ActiveRecord::Relation) }
 
       before do
         allow(Principal)
           .to receive(:in_visible_project_or_me)
-          .with(User.current)
-          .and_return(users)
+                .with(User.current)
+                .and_return(scope)
+
+        allow(scope)
+          .to receive(:select)
+                .and_return(users)
       end
 
       it_behaves_like "associated custom action validations" do
diff --git a/spec/models/custom_field_spec.rb b/spec/models/custom_field_spec.rb
index f448ba748120..67ecadbe568e 100644
--- a/spec/models/custom_field_spec.rb
+++ b/spec/models/custom_field_spec.rb
@@ -215,17 +215,27 @@
     let(:project) { build_stubbed(:project) }
     let(:user1) { build_stubbed(:user) }
     let(:user2) { build_stubbed(:user) }
+    let(:in_visible_scope) { instance_double(ActiveRecord::Relation) }
+    let(:principals_scope) { instance_double(ActiveRecord::Relation) }
 
     context "for a user custom field" do
       before do
         field.field_format = "user"
         allow(project)
           .to receive(:principals)
-          .and_return([user1, user2])
+                .and_return(principals_scope)
+
+        allow(principals_scope)
+          .to receive(:select)
+                .and_return([user1, user2])
 
         allow(Principal)
           .to receive(:in_visible_project_or_me)
-          .and_return([user2])
+                .and_return(in_visible_scope)
+
+        allow(in_visible_scope)
+          .to receive(:select)
+                .and_return([user2])
       end
 
       context "for a project" do