* fix bug #29834.

module/project/model.php

@@ -1,6 +1,22 @@
 <?php
 class projectModel extends model
 {
+    /**
+     * Check the privilege.
+     *
+     * @param  int    $projectID
+     * @access public
+     * @return bool
+     */
+    public function checkPriv($projectID)
+    {
+        if(empty($projectID)) return false;
+
+        /* If is admin, return true. */
+        if($this->app->user->admin) return true;
+        return (strpos(",{$this->app->user->view->projects},", ",{$projectID},") !== false);
+    }
+
     /**
      * Get Multiple linked products for project.
      *

module/release/model.php

@@ -66,7 +66,7 @@ class releaseModel extends model
             ->page($pager)
             ->fetchAll();
 
-        $builds = $this->dao->select("t1.id, t1.name, t1.execution, IF(t2.name IS NOT NULL, t2.name, '') AS projectName, IF(t3.name IS NOT NULL, t3.name, '{$this->lang->trunk}') AS branchName")
+        $builds = $this->dao->select("t1.id, t1.name, t1.project, t1.execution, IF(t2.name IS NOT NULL, t2.name, '') AS projectName, IF(t3.name IS NOT NULL, t3.name, '{$this->lang->trunk}') AS branchName")
             ->from(TABLE_BUILD)->alias('t1')
             ->leftJoin(TABLE_PROJECT)->alias('t2')->on('t1.project = t2.id')
             ->leftJoin(TABLE_BRANCH)->alias('t3')->on('t1.branch = t3.id')

module/release/view/browse.html.php

@@ -63,6 +63,10 @@
       </tr>
     </thead>
     <tbody>
+      <?php
+      $this->loadModel('project');
+      $this->loadModel('execution');
+      ?>
       <?php foreach($releases as $release):?>
       <?php $canBeChanged = common::canBeChanged('release', $release);?>
       <?php $buildCount    = count($release->builds);?>
@@ -82,7 +86,13 @@
           <?php if($product->type != 'normal'):?>
           <span class='label label-outline label-badge'><?php echo $build->branchName;?></span>
           <?php endif;?>
-          <?php echo html::a($this->createLink($build->execution ? 'build' : 'projectbuild', 'view', "buildID=$build->id"), $build->name);?>
+          <?php
+          $moduleName   = $build->execution ? 'build' : 'projectbuild';
+          $canClickable = false;
+          if($moduleName == 'projectbuild' and $this->project->checkPriv($build->project)) $canClickable = true;
+          if($moduleName == 'build' and $this->execution->checkPriv($build->execution))    $canClickable = true;
+          echo $canClickable ? html::a($this->createLink($moduleName, 'view', "buildID=$build->id"), $build->name, '', "data-app='project'") : $build->name;
+          ?>
         </td>
         <td><?php echo $build->projectName;?></td>
         <?php if($i == 1):?>

module/release/view/view.html.php

@@ -356,7 +356,12 @@
                         $buildHtml = array();
                         foreach($release->builds as $build)
                         {
-                            $buildHtml[] = html::a($this->createLink($build->execution ? 'build' : 'projectbuild', 'view', "buildID=$build->id"), $build->name, '', "data-app='project'");
+                            $moduleName   = $build->execution ? 'build' : 'projectbuild';
+                            $canClickable = false;
+                            if($moduleName == 'projectbuild' and $this->loadModel('project')->checkPriv($build->project)) $canClickable = true;
+                            if($moduleName == 'build' and $this->loadModel('execution')->checkPriv($build->execution))    $canClickable = true;
+
+                            $buildHtml[] = $canClickable ? html::a($this->createLink($moduleName, 'view', "buildID=$build->id"), $build->name, '', "data-app='project'") : $build->name;
                         }
                         echo join($lang->comma, $buildHtml);
                         ?>