Warning "Can't mass-assign protected attributes for IssueRelation: issue_to_id" (#21695).

git-svn-id: http://svn.redmine.org/redmine/trunk@15063 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 20 insertions, 0 deletions

diff --git a/app/models/issue_relation.rb b/app/models/issue_relation.rb
index 3e7e4235c..62d873eff 100644
--- a/app/models/issue_relation.rb
+++ b/app/models/issue_relation.rb
@@ -30,6 +30,8 @@ class IssueRelation < ActiveRecord::Base
     end
   end
 
+  include Redmine::SafeAttributes
+
   belongs_to :issue_from, :class_name => 'Issue'
   belongs_to :issue_to, :class_name => 'Issue'
 
@@ -75,6 +77,24 @@ class IssueRelation < ActiveRecord::Base
   after_create  :call_issues_relation_added_callback
   after_destroy :call_issues_relation_removed_callback
 
+  safe_attributes 'relation_type',
+    'delay',
+    'issue_to_id'
+
+  def safe_attributes=(attrs, user=User.current)
+    return unless attrs.is_a?(Hash)
+    attrs = attrs.deep_dup
+
+    if issue_id = attrs.delete('issue_to_id')
+      if issue_id.to_s.strip.match(/\A#?(\d+)\z/)
+        issue_id = $1.to_i
+        self.issue_to = Issue.visible(user).find_by_id(issue_id)
+      end
+    end
+    
+    super(attrs)
+  end
+
   def visible?(user=User.current)
     (issue_from.nil? || issue_from.visible?(user)) && (issue_to.nil? || issue_to.visible?(user))
   end