Prevent mass-assignment when adding/updating a wiki (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9138 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/wikis_controller.rb b/app/controllers/wikis_controller.rb
index 523b80678c2762d33a568b1488a5541aa11c4326..251b2a963e4c84d8d9862466cbc8690116f478d5 100644 (file)
--- a/app/controllers/wikis_controller.rb
+++ b/app/controllers/wikis_controller.rb
@@ -22,7 +22,7 @@ class WikisController < ApplicationController
   # Create or update a project's wiki
   def edit
     @wiki = @project.wiki || Wiki.new(:project => @project)
-    @wiki.attributes = params[:wiki]
+    @wiki.safe_attributes = params[:wiki]
     @wiki.save if request.post?
     render(:update) {|page| page.replace_html "tab-content-wiki", :partial => 'projects/settings/wiki'}
   end

diff --git a/app/models/wiki.rb b/app/models/wiki.rb
index 1b4301707e4c424eb99bd22d48028b0984293f4c..6cdfa246d2f63ea06d8264b75b7a27dd0df86e0c 100644 (file)
--- a/app/models/wiki.rb
+++ b/app/models/wiki.rb
@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class Wiki < ActiveRecord::Base
+  include Redmine::SafeAttributes
   belongs_to :project
   has_many :pages, :class_name => 'WikiPage', :dependent => :destroy, :order => 'title'
   has_many :redirects, :class_name => 'WikiRedirect', :dependent => :delete_all
@@ -25,6 +26,8 @@ class Wiki < ActiveRecord::Base
   validates_presence_of :start_page
   validates_format_of :start_page, :with => /^[^,\.\/\?\;\|\:]*$/
 
+  safe_attributes 'start_page'
+
   def visible?(user=User.current)
     !user.nil? && user.allowed_to?(:view_wiki_pages, project)
   end