From 5141f1e4741d93c7e187daa54dc3c87e5362134f Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Wed, 7 Mar 2012 18:22:06 +0000 Subject: [PATCH] Merged r9129 from trunk. git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.3-stable@9146 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/comments_controller.rb | 3 ++- app/models/comment.rb | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 230af5caf..a9e7a605e 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -7,7 +7,8 @@ class CommentsController < ApplicationController verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed } def create - @comment = Comment.new(params[:comment]) + @comment = Comment.new + @comment.safe_attributes = params[:comment] @comment.author = User.current if @news.comments << @comment flash[:notice] = l(:label_comment_added) diff --git a/app/models/comment.rb b/app/models/comment.rb index 701f0344e..4b7e098f1 100644 --- a/app/models/comment.rb +++ b/app/models/comment.rb @@ -16,8 +16,11 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Comment < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :commented, :polymorphic => true, :counter_cache => true belongs_to :author, :class_name => 'User', :foreign_key => 'author_id' validates_presence_of :commented, :author, :comments + + safe_attributes 'comments' end -- 2.39.5