Content
View differences
Updated by Alexander Coles 15 days ago
### Steps to reproduce
1. Enable the Budgets module and define at least one budget in the target project.
2. Select one or more work packages and choose Bulk edit → Move/Copy (or open the move form for a single work package).
3. In the move form pick a target project and select a value in the **Budget** field.
4. Submit the move/copy.
### What is the buggy behavior?
* The move/copy succeeds, but the selected budget is **not** assigned to the moved work package(s).
* The Budget field is silently ignored — no error and no notification is shown.
### What is the expected behavior?
* The budget chosen in the move form should be assigned to the moved/copied work packages (subject to the budget being valid in the target project).
### Root cause (technical)
* `PermittedParams#move_work_package` permits assigned\_to\_id, responsible\_id, start\_date, due\_date, status\_id, version\_id, priority\_id — but **not** `budget_id` (`app/models/permitted_params.rb`). No module extends the list.
* `WorkPackages::MovesController#attributes_for_create` builds job attributes from `permitted_params.move_work_package`, so `budget_id` is stripped by strong params before the bulk job runs.
* The move form still renders a Budget `<select>`, so the field appears editable but has no effect.
* Likely fix: add `budget_id` to `permitted_attributes[:move_work_package]` + request spec.
### Notes
* Found via code review while working on <mention class="mention" data-id="76432" data-type="work_package" data-text="#OP-19606" data-display-id="OP-19606">#OP-19606</mention> / <mention class="mention" data-id="76399" data-type="work_package" data-text="#SC-272" data-display-id="SC-272">#SC-272</mention> . Long-standing — the permitted-params list pre-dates that work. Affects dev and 17.6; not platform-specific.
### Environment information
**OpenProject installation type**
* Hosted cloud edition
**OpenProject version**
**Core build**
[07258a5df8a642e4d44e4bc60309a1fbdc30b061](https://qa.openproject-stage.com/external_redirect?url=https%3A%2F%2Fgithub.com%2Fopf%2Fopenproject%2Fcommit%2F07258a5df8a642e4d44e4bc60309a1fbdc30b061)
**Product version**
[3db21513fd7457f50849dce47a583687fac6667d](https://qa.openproject-stage.com/external_redirect?url=https%3A%2F%2Fgithub.com%2Fopf%2Fsaas-openproject%2Fcommit%2F3db21513fd7457f50849dce47a583687fac6667d)
**Core version**
_If you're not running on the cloud edition, please specify the version of OpenProject 17.6.0 you're running. Example: v12.1.5_
**Browser**
* [x] [ ] Chrome
* [ ] Firefox
* [ ] Safari
* [ ] Mobile Safari
* [ ] Other (please specify)
**Operating System**
* [ ] Windows
* [x] [ ] Mac OS X
* [ ] Mobile iOS
* [ ] Mobile Android
* [ ] Linux (please specify distro)
* [ ] Chrome OS
* [ ] Other (please specify)
**Language**
_en\_GB_ _Please specify the browser language and the language of the OpenProject user for which the bug occurred._
1. Enable the Budgets module and define at least one budget in the target project.
2. Select one or more work packages and choose Bulk edit → Move/Copy (or open the move form for a single work package).
3. In the move form pick a target project and select a value in the **Budget** field.
4. Submit the move/copy.
### What is the buggy behavior?
* The move/copy succeeds, but the selected budget is **not** assigned to the moved work package(s).
* The Budget field is silently ignored — no error and no notification is shown.
### What is the expected behavior?
* The budget chosen in the move form should be assigned to the moved/copied work packages (subject to the budget being valid in the target project).
### Root cause (technical)
* `PermittedParams#move_work_package` permits assigned\_to\_id, responsible\_id, start\_date, due\_date, status\_id, version\_id, priority\_id — but **not** `budget_id` (`app/models/permitted_params.rb`). No module extends the list.
* `WorkPackages::MovesController#attributes_for_create` builds job attributes from `permitted_params.move_work_package`, so `budget_id` is stripped by strong params before the bulk job runs.
* The move form still renders a Budget `<select>`, so the field appears editable but has no effect.
* Likely fix: add `budget_id` to `permitted_attributes[:move_work_package]` + request spec.
### Notes
* Found via code review while working on <mention class="mention" data-id="76432" data-type="work_package" data-text="#OP-19606" data-display-id="OP-19606">#OP-19606</mention> / <mention class="mention" data-id="76399" data-type="work_package" data-text="#SC-272" data-display-id="SC-272">#SC-272</mention> . Long-standing — the permitted-params list pre-dates that work. Affects dev and 17.6; not platform-specific.
### Environment information
**OpenProject installation type**
* Hosted cloud edition
**OpenProject version**
**Core build**
[07258a5df8a642e4d44e4bc60309a1fbdc30b061](https://qa.openproject-stage.com/external_redirect?url=https%3A%2F%2Fgithub.com%2Fopf%2Fopenproject%2Fcommit%2F07258a5df8a642e4d44e4bc60309a1fbdc30b061)
**Product version**
[3db21513fd7457f50849dce47a583687fac6667d](https://qa.openproject-stage.com/external_redirect?url=https%3A%2F%2Fgithub.com%2Fopf%2Fsaas-openproject%2Fcommit%2F3db21513fd7457f50849dce47a583687fac6667d)
**Core version**
**Browser**
* [x]
* [ ] Firefox
* [ ] Safari
* [ ] Mobile Safari
* [ ] Other (please specify)
**Operating System**
* [ ] Windows
* [x]
* [ ] Mobile iOS
* [ ] Mobile Android
* [ ] Linux (please specify distro)
* [ ] Chrome OS
* [ ] Other (please specify)
**Language**
_en\_GB_