diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 19:50:10 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 19:50:10 +0000 |
| commit | d0356fe935330d2c74130572eae5883358d7f997 (patch) | |
| tree | cff40610e31a5ba97f939cb9ca55e443c3d4220e /app/models/news.rb | |
| parent | 286bda14f14d5824975ac46de7c79a8d0181a1e2 (diff) | |
| download | redmine-d0356fe935330d2c74130572eae5883358d7f997.tar.gz redmine-d0356fe935330d2c74130572eae5883358d7f997.zip | |
Prevent mass-assignment when adding/updating a news (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9134 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/news.rb')
| -rw-r--r-- | app/models/news.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/models/news.rb b/app/models/news.rb index eed17945e..1f7c6f4a7 100644 --- a/app/models/news.rb +++ b/app/models/news.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class News < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project belongs_to :author, :class_name => 'User', :foreign_key => 'author_id' has_many :comments, :as => :commented, :dependent => :delete_all, :order => "created_on" @@ -38,6 +39,8 @@ class News < ActiveRecord::Base :conditions => Project.allowed_to_condition(args.shift || User.current, :view_news, *args) }} + safe_attributes 'title', 'summary', 'description' + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_news, project) end |