diff options
| -rw-r--r-- | app/controllers/boards_controller.rb | 9 | ||||
| -rw-r--r-- | app/models/board.rb | 3 | ||||
| -rw-r--r-- | test/functional/boards_controller_test.rb | 8 |
3 files changed, 17 insertions, 3 deletions
diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb index e4d7749bc..380933960 100644 --- a/app/controllers/boards_controller.rb +++ b/app/controllers/boards_controller.rb @@ -60,11 +60,13 @@ class BoardsController < ApplicationController end def new - @board = @project.boards.build(params[:board]) + @board = @project.boards.build + @board.safe_attributes = params[:board] end def create - @board = @project.boards.build(params[:board]) + @board = @project.boards.build + @board.safe_attributes = params[:board] if @board.save flash[:notice] = l(:notice_successful_create) redirect_to_settings_in_projects @@ -77,7 +79,8 @@ class BoardsController < ApplicationController end def update - if @board.update_attributes(params[:board]) + @board.safe_attributes = params[:board] + if @board.save redirect_to_settings_in_projects else render :action => 'edit' diff --git a/app/models/board.rb b/app/models/board.rb index a76868d09..40fd35673 100644 --- a/app/models/board.rb +++ b/app/models/board.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class Board < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project has_many :topics, :class_name => 'Message', :conditions => "#{Message.table_name}.parent_id IS NULL", :order => "#{Message.table_name}.created_on DESC" has_many :messages, :dependent => :destroy, :order => "#{Message.table_name}.created_on DESC" @@ -30,6 +31,8 @@ class Board < ActiveRecord::Base named_scope :visible, lambda {|*args| { :include => :project, :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } } + safe_attributes 'name', 'description', 'move_to' + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_messages, project) end diff --git a/test/functional/boards_controller_test.rb b/test/functional/boards_controller_test.rb index c848b3e1a..03dee9de8 100644 --- a/test/functional/boards_controller_test.rb +++ b/test/functional/boards_controller_test.rb @@ -122,6 +122,14 @@ class BoardsControllerTest < ActionController::TestCase assert_equal 'Testing', Board.find(2).name end + def test_update_position + @request.session[:user_id] = 2 + put :update, :project_id => 1, :id => 2, :board => { :move_to => 'highest'} + assert_redirected_to '/projects/ecookbook/settings/boards' + board = Board.find(2) + assert_equal 1, board.position + end + def test_update_with_failure @request.session[:user_id] = 2 put :update, :project_id => 1, :id => 2, :board => { :name => '', :description => 'Testing board update'} |