diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 19:46:59 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 19:46:59 +0000 |
| commit | 286bda14f14d5824975ac46de7c79a8d0181a1e2 (patch) | |
| tree | e4ccfacebd2ddfef25368ed87051df129677036e /app/models/message.rb | |
| parent | 2c6ad7525aa77c5c52cbcecb39e8654be11b9f75 (diff) | |
| download | redmine-286bda14f14d5824975ac46de7c79a8d0181a1e2.tar.gz redmine-286bda14f14d5824975ac46de7c79a8d0181a1e2.zip | |
Prevent mass-assignment when adding/updating a forum message (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9133 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/message.rb')
| -rw-r--r-- | app/models/message.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/app/models/message.rb b/app/models/message.rb index 3866a3a04..5721cb571 100644 --- a/app/models/message.rb +++ b/app/models/message.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Message < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :board belongs_to :author, :class_name => 'User', :foreign_key => 'author_id' acts_as_tree :counter_cache => :replies_count, :order => "#{Message.table_name}.created_on ASC" @@ -48,6 +49,12 @@ class Message < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => {:board => :project}, :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } } + safe_attributes 'subject', 'content' + safe_attributes 'locked', 'sticky', + :if => lambda {|message, user| + user.allowed_to?(:edit_messages, message.project) + } + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_messages, project) end |