diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:31:45 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:31:45 +0000 |
| commit | fef2e4b67252415fefe54da856db3a77c3143dfe (patch) | |
| tree | 505c20946af6fca04277a1d616817abd607d6048 /app/models/version.rb | |
| parent | 1ec2d98c14bd4ba8291c236438f97a30bf2109f3 (diff) | |
| download | redmine-fef2e4b67252415fefe54da856db3a77c3143dfe.tar.gz redmine-fef2e4b67252415fefe54da856db3a77c3143dfe.zip | |
Prevent mass-assignment when adding/updating a version (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9137 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/models/version.rb')
| -rw-r--r-- | app/models/version.rb | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/app/models/version.rb b/app/models/version.rb index 2d2176764..24be5df02 100644 --- a/app/models/version.rb +++ b/app/models/version.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Version < ActiveRecord::Base + include Redmine::SafeAttributes after_update :update_issues_from_sharing_change belongs_to :project has_many :fixed_issues, :class_name => 'Issue', :foreign_key => 'fixed_version_id', :dependent => :nullify @@ -38,6 +39,15 @@ class Version < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => :project, :conditions => Project.allowed_to_condition(args.first || User.current, :view_issues) } } + safe_attributes 'name', + 'description', + 'effective_date', + 'due_date', + 'wiki_page_title', + 'status', + 'sharing', + 'custom_field_values' + # Returns true if +user+ or current user is allowed to view the version def visible?(user=User.current) user.allowed_to?(:view_issues, self.project) |