Scarab commit: svn commit: r10471 - trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java

Author: hair
Date: 2007-10-27 14:27:56-0700
New Revision: 10471

Modified:
   trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java

Log:
permissions around exporting cross-module issues


Modified: trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java
Url: http://scarab.tigris.org/source/browse/scarab/trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java?view=diff&rev=10471&p1=trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java&p2=trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java&r1=10470&r2=10471
==============================================================================
--- trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java	(original)
+++ trunk/src/java/org/tigris/scarab/screens/admin/ViewXMLExportIssues.java	2007-10-27 14:27:56-0700
@@ -58,6 +58,8 @@
 import org.apache.turbine.Turbine;
 import org.tigris.scarab.actions.Search;
 import org.tigris.scarab.om.Module;
+import org.tigris.scarab.om.ScarabUser;
+import org.tigris.scarab.services.security.ScarabSecurity;
 
 import org.tigris.scarab.tools.ScarabRequestTool;
 import org.tigris.scarab.tools.ScarabLocalizationTool;
@@ -81,6 +83,7 @@
     public void doBuildTemplate(RunData data, TemplateContext context)
         throws Exception 
     {
+              
         super.doBuildTemplate(data, context);
 
         // probably should use intake, but i'm being lazy for now cause
@@ -102,6 +105,8 @@
         final Module currentModule = scarabR.getCurrentModule();
         final ScarabLocalizationTool l10n = getLocalizationTool(context);
         
+        final ScarabUser user = (ScarabUser)data.getUser();
+        
         // new functionality allows query parameter to select which issues to print
         final String query = data.getParameters().getString("go");
         String ids = null;
@@ -115,11 +120,15 @@
             while(it.hasNext())
             {
                 final QueryResult issue = (QueryResult)it.next();
-                sb.append(issue.getUniqueId());
-                allIdList.add(issue.getUniqueId());
-                if(it.hasNext())
-                {
-                    sb.append(',');
+                // only add the result if the user would otherwise be able to view it.
+                if( user.hasPermission(ScarabSecurity.ISSUE__VIEW, issue.getIssue().getModule()) ){
+                    
+                    sb.append(issue.getIssue().getIdPrefix()+issue.getIssue().getIdCount());
+                    allIdList.add(issue.getIssue().getIdPrefix()+issue.getIssue().getIdCount());
+                    if(it.hasNext())
+                    {
+                        sb.append(',');
+                    }
                 }
             }
             ids = sb.toString();