diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:23:00 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:23:00 +0000 |
| commit | 1ec2d98c14bd4ba8291c236438f97a30bf2109f3 (patch) | |
| tree | c38c271c8f04d4a38b1d850314445d462d0016f3 /app/models/time_entry.rb | |
| parent | 0ee1de568697dd7b6d9dcc13fb68932a3f009eb7 (diff) | |
| download | redmine-1ec2d98c14bd4ba8291c236438f97a30bf2109f3.tar.gz redmine-1ec2d98c14bd4ba8291c236438f97a30bf2109f3.zip | |
Prevent mass-assignment when adding/updating a time entry (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9136 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/time_entry.rb')
| -rw-r--r-- | app/models/time_entry.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb index 9266eb86f..6dbf78413 100644 --- a/app/models/time_entry.rb +++ b/app/models/time_entry.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class TimeEntry < ActiveRecord::Base + include Redmine::SafeAttributes # could have used polymorphic association # project association here allows easy loading of time entries at project level with one database trip belongs_to :project @@ -65,6 +66,8 @@ class TimeEntry < ActiveRecord::Base end } + safe_attributes 'hours', 'comments', 'issue_id', 'activity_id', 'spent_on', 'custom_field_values' + def initialize(attributes=nil, *args) super if new_record? && self.activity.nil? |