From 969d014050e95d6f999bc5f6cec3b5411f1e68c4 Mon Sep 17 00:00:00 2001
From: Florian Krupicka <krupicka@synyx.de>
Date: Tue, 3 Jan 2017 11:23:17 +0100
Subject: [PATCH 1/3] Update installation instructions in README

Since Redmine uses the plugin identifier (see `init.rb`) when later
on referencing views & assets, the name of the plugins folder is
important.
---
 README.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f731598..a6b70ad 100644
--- a/README.md
+++ b/README.md
@@ -30,8 +30,12 @@ The plugin is compatible with Redmine 3.3.X
 
 ## Installation and Setup
 
-1. Clone this repository to your Redmine `plugins/` directory.
-2. Restart web server
+1.  Clone this repository to your Redmine as `plugins/timesheet`:
+
+    `$ git clone https://github.com/Contargo/redmine-timesheet-plugin plugins/timesheet`
+
+    The name is important, because of the way the Redmine plugin system works.
+2.  Restart web server
 
 ## License
 

From a519609e1eaf7ee71752ae07ae86bf150855f18f Mon Sep 17 00:00:00 2001
From: Michael Richardson <mcr@sandelman.ca>
Date: Thu, 2 Oct 2025 20:49:37 -0400
Subject: [PATCH 2/3] feat: updated for zeitwek

---
 app/models/timesheet_query.rb | 2 +-
 init.rb                       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/models/timesheet_query.rb b/app/models/timesheet_query.rb
index 4c47fb3..e303555 100644
--- a/app/models/timesheet_query.rb
+++ b/app/models/timesheet_query.rb
@@ -1,4 +1,4 @@
-require 'timesheet_plugin/permission_helper'
+require File.expand_path('../../../lib/timesheet_plugin/permission_helper', __FILE__)
 
 class TimesheetQuery < TimeEntryQuery
 
diff --git a/init.rb b/init.rb
index 8f5d1ca..07132f4 100644
--- a/init.rb
+++ b/init.rb
@@ -1,5 +1,5 @@
 require 'redmine'
-require 'timesheet_plugin/permission_helper'
+require File.expand_path('../lib/timesheet_plugin/permission_helper', __FILE__)
 
 Redmine::Plugin.register :timesheet do
   name 'Timesheet Plugin'

From 02f399310f5d7e518fb39b69cdd565f83b560cf1 Mon Sep 17 00:00:00 2001
From: Michael Richardson <mcr@sandelman.ca>
Date: Thu, 2 Oct 2025 20:49:47 -0400
Subject: [PATCH 3/3] feat: much hacking to fix params restriction, update
 context_menu call and make sure @query is set

---
 app/controllers/timesheets_controller.rb | 4 +++-
 app/views/timesheets/_list.html.erb      | 5 ++---
 app/views/timesheets/show.html.erb       | 6 +++---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/app/controllers/timesheets_controller.rb b/app/controllers/timesheets_controller.rb
index 2ab7756..fa11334 100644
--- a/app/controllers/timesheets_controller.rb
+++ b/app/controllers/timesheets_controller.rb
@@ -17,7 +17,7 @@ class TimesheetsController < ApplicationController
   # GET /timesheet.json
   # GET /timesheet.csv
   def show
-    sort_init(@timesheet.query.sort_criteria.empty? ? [['spent_on', 'desc']] : @query.sort_criteria)
+    sort_init(@timesheet.query.sort_criteria.empty? ? [['spent_on', 'desc']] : @query.try(:sort_criteria))
     sort_update(@timesheet.query.sortable_columns)
 
     scope = @timesheet.query.results_scope(:order => sort_clause)
@@ -29,6 +29,8 @@ def show
         @entries = scope.offset(@entry_pages.offset).limit(@entry_pages.per_page).to_a
         @total_hours = scope.sum(:hours).to_f
 
+	@query=@timesheet.query
+	
         render :layout => !request.xhr?
       }
       format.api  {
diff --git a/app/views/timesheets/_list.html.erb b/app/views/timesheets/_list.html.erb
index 825b202..3452eb7 100644
--- a/app/views/timesheets/_list.html.erb
+++ b/app/views/timesheets/_list.html.erb
@@ -1,5 +1,4 @@
 <%= form_tag({}) do -%>
-<%= hidden_field_tag 'back_url', url_for(params), :id => nil %>
 <div class="autoscroll">
 <table class="list time_entries <%= sort_css_classes %>">
   <thead>
@@ -9,7 +8,7 @@
               :title => "#{l(:button_check_all)}/#{l(:button_uncheck_all)}" %>
       </th>
       <% query.inline_columns.each do |column| %>
-        <%= column_header(column) %>
+        <%= column_header(query,column) %>
       <% end %>
     </tr>
   </thead>
@@ -43,4 +42,4 @@
 </div>
 <% end -%>
 
-<%= context_menu time_entries_context_menu_path %>
+<%= context_menu %>
diff --git a/app/views/timesheets/show.html.erb b/app/views/timesheets/show.html.erb
index 7f39acd..aafb26a 100644
--- a/app/views/timesheets/show.html.erb
+++ b/app/views/timesheets/show.html.erb
@@ -1,6 +1,6 @@
 <div class="contextual">
 <% other_formats_links do |f| %>
-    <%= f.link_to 'CSV', :url => params, :onclick => "showModal('csv-export-options', '330px'); return false;" %>
+    <%= f.link_to 'CSV', :url => params.to_unsafe_hash, :onclick => "showModal('csv-export-options', '330px'); return false;" %>
 <% end %>
 </div>
 
@@ -16,7 +16,7 @@
 
 <div id="csv-export-options" style="display:none;">
   <h3 class="title"><%= l(:label_export_options, :export_format => 'CSV') %></h3>
-  <%= form_tag(params.slice(:project_id, :issue_id).merge(:format => 'csv', :page => nil), :method => :get, :id => 'csv-export-form') do %>
+  <%= form_tag(params.permit(:project_id, :issue_id).slice(:project_id, :issue_id).merge(:format => 'csv', :page => nil), :method => :get, :id => 'csv-export-form') do %>
       <%= query_hidden_tags @timesheet.query %>
       <p>
         <label><%= radio_button_tag 'columns', '', true %> <%= l(:description_visible_columns) %></label><br/>
@@ -29,4 +29,4 @@
   <% end %>
 </div>
 
-<% html_title l(:timesheet_title) %>
\ No newline at end of file
+<% html_title l(:timesheet_title) %>