diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:31:45 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2012-03-06 20:31:45 +0000 |
| commit | fef2e4b67252415fefe54da856db3a77c3143dfe (patch) | |
| tree | 505c20946af6fca04277a1d616817abd607d6048 /app | |
| parent | 1ec2d98c14bd4ba8291c236438f97a30bf2109f3 (diff) | |
| download | redmine-fef2e4b67252415fefe54da856db3a77c3143dfe.tar.gz redmine-fef2e4b67252415fefe54da856db3a77c3143dfe.zip | |
Prevent mass-assignment when adding/updating a version (#10390).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9137 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/versions_controller.rb | 8 | ||||
| -rw-r--r-- | app/models/version.rb | 10 |
2 files changed, 15 insertions, 3 deletions
diff --git a/app/controllers/versions_controller.rb b/app/controllers/versions_controller.rb index ddbda38d3..ec9f41e46 100644 --- a/app/controllers/versions_controller.rb +++ b/app/controllers/versions_controller.rb @@ -73,7 +73,8 @@ class VersionsController < ApplicationController end def new - @version = @project.versions.build(params[:version]) + @version = @project.versions.build + @version.safe_attributes = params[:version] respond_to do |format| format.html @@ -92,7 +93,7 @@ class VersionsController < ApplicationController if params[:version] attributes = params[:version].dup attributes.delete('sharing') unless attributes.nil? || @version.allowed_sharings.include?(attributes['sharing']) - @version.attributes = attributes + @version.safe_attributes = attributes end if request.post? @@ -136,7 +137,8 @@ class VersionsController < ApplicationController if request.put? && params[:version] attributes = params[:version].dup attributes.delete('sharing') unless @version.allowed_sharings.include?(attributes['sharing']) - if @version.update_attributes(attributes) + @version.safe_attributes = attributes + if @version.save respond_to do |format| format.html { flash[:notice] = l(:notice_successful_update) diff --git a/app/models/version.rb b/app/models/version.rb index 2d2176764..24be5df02 100644 --- a/app/models/version.rb +++ b/app/models/version.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Version < ActiveRecord::Base + include Redmine::SafeAttributes after_update :update_issues_from_sharing_change belongs_to :project has_many :fixed_issues, :class_name => 'Issue', :foreign_key => 'fixed_version_id', :dependent => :nullify @@ -38,6 +39,15 @@ class Version < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => :project, :conditions => Project.allowed_to_condition(args.first || User.current, :view_issues) } } + safe_attributes 'name', + 'description', + 'effective_date', + 'due_date', + 'wiki_page_title', + 'status', + 'sharing', + 'custom_field_values' + # Returns true if +user+ or current user is allowed to view the version def visible?(user=User.current) user.allowed_to?(:view_issues, self.project) |