From 2bcf9f28710b527ff9efbc68fc228593a243e65f Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Tue, 6 Mar 2012 21:36:28 +0000
Subject: [PATCH] Prevent mass-assignment when adding/updating a forum
 (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9140 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/controllers/boards_controller.rb      | 9 ++++++---
 app/models/board.rb                       | 3 +++
 test/functional/boards_controller_test.rb | 8 ++++++++
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb
index e4d7749bc..380933960 100644
--- a/app/controllers/boards_controller.rb
+++ b/app/controllers/boards_controller.rb
@@ -60,11 +60,13 @@ class BoardsController < ApplicationController
   end
 
   def new
-    @board = @project.boards.build(params[:board])
+    @board = @project.boards.build
+    @board.safe_attributes = params[:board]
   end
 
   def create
-    @board = @project.boards.build(params[:board])
+    @board = @project.boards.build
+    @board.safe_attributes = params[:board]
     if @board.save
       flash[:notice] = l(:notice_successful_create)
       redirect_to_settings_in_projects
@@ -77,7 +79,8 @@ class BoardsController < ApplicationController
   end
 
   def update
-    if @board.update_attributes(params[:board])
+    @board.safe_attributes = params[:board]
+    if @board.save
       redirect_to_settings_in_projects
     else
       render :action => 'edit'
diff --git a/app/models/board.rb b/app/models/board.rb
index a76868d09..40fd35673 100644
--- a/app/models/board.rb
+++ b/app/models/board.rb
@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class Board < ActiveRecord::Base
+  include Redmine::SafeAttributes
   belongs_to :project
   has_many :topics, :class_name => 'Message', :conditions => "#{Message.table_name}.parent_id IS NULL", :order => "#{Message.table_name}.created_on DESC"
   has_many :messages, :dependent => :destroy, :order => "#{Message.table_name}.created_on DESC"
@@ -30,6 +31,8 @@ class Board < ActiveRecord::Base
   named_scope :visible, lambda {|*args| { :include => :project,
                                           :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } }
 
+  safe_attributes 'name', 'description', 'move_to'
+
   def visible?(user=User.current)
     !user.nil? && user.allowed_to?(:view_messages, project)
   end
diff --git a/test/functional/boards_controller_test.rb b/test/functional/boards_controller_test.rb
index c848b3e1a..03dee9de8 100644
--- a/test/functional/boards_controller_test.rb
+++ b/test/functional/boards_controller_test.rb
@@ -122,6 +122,14 @@ class BoardsControllerTest < ActionController::TestCase
     assert_equal 'Testing', Board.find(2).name
   end
 
+  def test_update_position
+    @request.session[:user_id] = 2
+    put :update, :project_id => 1, :id => 2, :board => { :move_to => 'highest'}
+    assert_redirected_to '/projects/ecookbook/settings/boards'
+    board = Board.find(2)
+    assert_equal 1, board.position
+  end
+
   def test_update_with_failure
     @request.session[:user_id] = 2
     put :update, :project_id => 1, :id => 2, :board => { :name => '', :description => 'Testing board update'}
-- 
2.39.5