[#4862] Fix deleted ticket visibility in subproject tracker
Signed-off-by: Tim Van Steenburgh <tvansteenburgh@gmail.com>
diff --git a/ForgeTracker/forgetracker/model/ticket.py b/ForgeTracker/forgetracker/model/ticket.py
index 6fb1f80..e4b8c0f 100644
--- a/ForgeTracker/forgetracker/model/ticket.py
+++ b/ForgeTracker/forgetracker/model/ticket.py
@@ -824,7 +824,7 @@
tickets = []
for tn in ticket_numbers:
if tn in ticket_for_num:
- show_deleted = show_deleted and security.has_access(ticket_for_num[tn], 'delete', user, app_config.project)
+ show_deleted = show_deleted and security.has_access(ticket_for_num[tn], 'delete', user, app_config.project.root_project)
if (security.has_access(ticket_for_num[tn], 'read', user, app_config.project.root_project) and
(show_deleted or ticket_for_num[tn].deleted==False)):
tickets.append(ticket_for_num[tn])
diff --git a/ForgeTracker/forgetracker/tests/functional/test_root.py b/ForgeTracker/forgetracker/tests/functional/test_root.py
index 84587d7..3af8925 100644
--- a/ForgeTracker/forgetracker/tests/functional/test_root.py
+++ b/ForgeTracker/forgetracker/tests/functional/test_root.py
@@ -178,9 +178,6 @@
def test_index_page_ticket_visibility(self):
"""Test that non-admin users can see tickets created by admins."""
self.new_ticket(summary="my ticket", mount_point="/sub1/tickets/")
- ThreadLocalORMSession.flush_all()
- M.MonQTask.run_ready()
- ThreadLocalORMSession.flush_all()
response = self.app.get('/p/test/sub1/tickets/',
extra_environ=dict(username='*anonymous'))
assert 'my ticket' in response
@@ -196,6 +193,19 @@
extra_environ=dict(username='*anonymous'))
assert 'my ticket' in response, response.showbrowser()
+ @td.with_tool('test/sub1', 'Tickets', 'tickets')
+ def test_deleted_ticket_visibility(self):
+ """Test that admins can see deleted tickets in a subproject tracker."""
+ self.new_ticket(summary='test', mount_point="/sub1/tickets/")
+ self.app.post('/sub1/tickets/1/delete')
+ ThreadLocalORMSession.flush_all()
+ M.MonQTask.run_ready()
+ ThreadLocalORMSession.flush_all()
+ r = self.app.get('/p/test/sub1/tickets/search/',
+ params=dict(q='test', deleted='True'))
+ assert '<td><a href="/p/test/sub1/tickets/1/">test' in r
+ assert '<tr class=" deleted">' in r
+
class TestFunctionalController(TrackerTestController):
def test_bad_ticket_number(self):
