diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 21:36:28 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 21:36:28 +0000 |
| commit | 2bcf9f28710b527ff9efbc68fc228593a243e65f (patch) | |
| tree | 91918fb8f994a06cb0b770a11cfb3db7e2102187 /app/models/board.rb | |
| parent | 87356648f659c8ed9e1310b81a77e7fdeec332af (diff) | |
| download | redmine-2bcf9f28710b527ff9efbc68fc228593a243e65f.tar.gz redmine-2bcf9f28710b527ff9efbc68fc228593a243e65f.zip | |
Prevent mass-assignment when adding/updating a forum (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9140 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/board.rb')
| -rw-r--r-- | app/models/board.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/models/board.rb b/app/models/board.rb index a76868d09..40fd35673 100644 --- a/app/models/board.rb +++ b/app/models/board.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Board < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project has_many :topics, :class_name => 'Message', :conditions => "#{Message.table_name}.parent_id IS NULL", :order => "#{Message.table_name}.created_on DESC" has_many :messages, :dependent => :destroy, :order => "#{Message.table_name}.created_on DESC" @@ -30,6 +31,8 @@ class Board < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => :project, :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } } + safe_attributes 'name', 'description', 'move_to' + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_messages, project) end |