diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 21:36:28 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 21:36:28 +0000 |
| commit | 2bcf9f28710b527ff9efbc68fc228593a243e65f (patch) | |
| tree | 91918fb8f994a06cb0b770a11cfb3db7e2102187 /app/controllers/boards_controller.rb | |
| parent | 87356648f659c8ed9e1310b81a77e7fdeec332af (diff) | |
| download | redmine-2bcf9f28710b527ff9efbc68fc228593a243e65f.tar.gz redmine-2bcf9f28710b527ff9efbc68fc228593a243e65f.zip | |
Prevent mass-assignment when adding/updating a forum (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9140 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers/boards_controller.rb')
| -rw-r--r-- | app/controllers/boards_controller.rb | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb index e4d7749bc..380933960 100644 --- a/app/controllers/boards_controller.rb +++ b/app/controllers/boards_controller.rb @@ -60,11 +60,13 @@ class BoardsController < ApplicationController end def new - @board = @project.boards.build(params[:board]) + @board = @project.boards.build + @board.safe_attributes = params[:board] end def create - @board = @project.boards.build(params[:board]) + @board = @project.boards.build + @board.safe_attributes = params[:board] if @board.save flash[:notice] = l(:notice_successful_create) redirect_to_settings_in_projects @@ -77,7 +79,8 @@ class BoardsController < ApplicationController end def update - if @board.update_attributes(params[:board]) + @board.safe_attributes = params[:board] + if @board.save redirect_to_settings_in_projects else render :action => 'edit' |