diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 18:54:41 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 18:54:41 +0000 |
| commit | 809d35d34bc438669719676fa8485610efeb67a5 (patch) | |
| tree | 6e04d9b8d566c9b032e8d5b3cd57f1a1484fa3f5 /app/controllers | |
| parent | bdf6e90f055ae09b7129e73ec062e3e020f01467 (diff) | |
| download | redmine-809d35d34bc438669719676fa8485610efeb67a5.tar.gz redmine-809d35d34bc438669719676fa8485610efeb67a5.zip | |
Prevent mass-assignment when adding/updating a document (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9130 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/documents_controller.rb | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/app/controllers/documents_controller.rb b/app/controllers/documents_controller.rb index 262088ed2..a33f49f66 100644 --- a/app/controllers/documents_controller.rb +++ b/app/controllers/documents_controller.rb @@ -47,11 +47,13 @@ class DocumentsController < ApplicationController end def new - @document = @project.documents.build(params[:document]) + @document = @project.documents.build + @document.safe_attributes = params[:document] end def create - @document = @project.documents.build(params[:document]) + @document = @project.documents.build + @document.safe_attributes = params[:document] @document.save_attachments(params[:attachments]) if @document.save render_attachment_warning_if_needed(@document) @@ -66,7 +68,8 @@ class DocumentsController < ApplicationController end def update - if request.put? and @document.update_attributes(params[:document]) + @document.safe_attributes = params[:document] + if request.put? and @document.save flash[:notice] = l(:notice_successful_update) redirect_to :action => 'show', :id => @document else |