permission, gemfile.lock

plugins/workflow_report/Gemfile.lock

+GEM
+  specs:
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    descendants_tracker (0.0.4)
+      thread_safe (~> 0.3, >= 0.3.1)
+    faraday (1.0.1)
+      multipart-post (>= 1.2, < 3)
+    github_api (0.19.0)
+      addressable (~> 2.4)
+      descendants_tracker (~> 0.0.4)
+      faraday (>= 0.8, < 2)
+      hashie (~> 3.5, >= 3.5.2)
+      oauth2 (~> 1.0)
+    hashie (3.6.0)
+    jwt (2.3.0)
+    multi_json (1.13.0)
+    multi_xml (0.6.0)
+    multipart-post (2.3.0)
+    oauth2 (1.4.11)
+      faraday (>= 0.17.3, < 3.0)
+      jwt (>= 1.0, < 3.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+    public_suffix (3.0.1)
+    rack (1.6.8)
+    thread_safe (0.3.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  github_api (~> 0.19.0)
+
+BUNDLED WITH
+   1.17.3

plugins/workflow_report/app/controllers/workflow_report_controller.rb

 require 'csv'
 
 class WorkflowReportController < ApplicationController
+  before_action :authorize_global
+  before_action :require_xhr_request, only: :export
 
   def index
     @team_options = $workflow_report_config['teams'].map { |team| team.keys() }
@@ -239,4 +241,8 @@ class WorkflowReportController < ApplicationController
     end
     name.strip
   end
+
+  def require_xhr_request
+    head :unprocessable_entity unless request.xhr?
+  end
 end

plugins/workflow_report/config/routes.rb

@@ -3,4 +3,3 @@
 
 get 'workflow_report', to: 'workflow_report#index'
 get 'workflow_report/export', to: 'workflow_report#export'
-get '/download_csv', to: 'workflow_report#export_csv'

plugins/workflow_report/init.rb

@@ -13,5 +13,21 @@ Redmine::Plugin.register :workflow_report do
   author_url 'http://example.com/about'
   configfile = File.join(File.dirname(__FILE__), 'config', 'settings.yml')
   $workflow_report_config = YAML::load_file(configfile)
-  menu :top_menu, :workflow_report, { controller: 'workflow_report', action: 'index' }, caption: 'Workflow Report'
 end
+
+Redmine::MenuManager.map :top_menu do |menu|
+  menu.push(:workflow_report, { controller: 'workflow_report', action: 'index' },
+            caption: 'Workflow Report',
+            if: proc { User.current.allowed_to_globally?(:view_workflow_report) })
+end
+
+ActionDispatch::Reloader.to_prepare do
+  Redmine::AccessControl.map do |map|
+    map.project_module :workflow_report do |pmap|
+      pmap.permission(:view_workflow_report, {
+        workflow_report: [:index, :export],
+      }, read: true)
+    end
+  end
+end
+