From 9f531a4380852c466c62bb55734b347a03b82e55 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Fri, 1 Jun 2012 19:06:16 +0000 Subject: [PATCH] Use safe_attributes in GroupsController. git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9746 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/groups_controller.rb | 6 ++++-- app/models/group.rb | 7 +++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb index 4b05d02ef..834c27ec1 100644 --- a/app/controllers/groups_controller.rb +++ b/app/controllers/groups_controller.rb @@ -63,7 +63,8 @@ class GroupsController < ApplicationController # POST /groups # POST /groups.xml def create - @group = Group.new(params[:group]) + @group = Group.new + @group.safe_attributes = params[:group] respond_to do |format| if @group.save @@ -83,9 +84,10 @@ class GroupsController < ApplicationController # PUT /groups/1.xml def update @group = Group.find(params[:id]) + @group.safe_attributes = params[:group] respond_to do |format| - if @group.update_attributes(params[:group]) + if @group.save flash[:notice] = l(:notice_successful_update) format.html { redirect_to(groups_path) } format.xml { head :ok } diff --git a/app/models/group.rb b/app/models/group.rb index 80c97c3ac..a269c5c16 100644 --- a/app/models/group.rb +++ b/app/models/group.rb @@ -16,6 +16,8 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Group < Principal + include Redmine::SafeAttributes + has_and_belongs_to_many :users, :after_add => :user_added, :after_remove => :user_removed @@ -27,6 +29,11 @@ class Group < Principal before_destroy :remove_references_before_destroy + safe_attributes 'name', + 'custom_field_values', + 'custom_fields', + :if => lambda {|group, user| user.admin?} + def to_s lastname.to_s end -- 2.39.5