diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 18:54:41 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 18:54:41 +0000 |
| commit | 809d35d34bc438669719676fa8485610efeb67a5 (patch) | |
| tree | 6e04d9b8d566c9b032e8d5b3cd57f1a1484fa3f5 /app/models/document.rb | |
| parent | bdf6e90f055ae09b7129e73ec062e3e020f01467 (diff) | |
| download | redmine-809d35d34bc438669719676fa8485610efeb67a5.tar.gz redmine-809d35d34bc438669719676fa8485610efeb67a5.zip | |
Prevent mass-assignment when adding/updating a document (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9130 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/document.rb')
| -rw-r--r-- | app/models/document.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/models/document.rb b/app/models/document.rb index 0917f8449..d4a89ffd9 100644 --- a/app/models/document.rb +++ b/app/models/document.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Document < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project belongs_to :category, :class_name => "DocumentCategory", :foreign_key => "category_id" acts_as_attachable :delete_permission => :manage_documents @@ -32,6 +33,8 @@ class Document < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => :project, :conditions => Project.allowed_to_condition(args.shift || User.current, :view_documents, *args) } } + safe_attributes 'category_id', 'title', 'description' + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_documents, project) end |