diff options
| -rw-r--r-- | app/controllers/news_controller.rb | 5 | ||||
| -rw-r--r-- | app/models/news.rb | 3 |
2 files changed, 6 insertions, 2 deletions
diff --git a/app/controllers/news_controller.rb b/app/controllers/news_controller.rb index 03a7ba29e..553f80e2f 100644 --- a/app/controllers/news_controller.rb +++ b/app/controllers/news_controller.rb @@ -68,7 +68,7 @@ class NewsController < ApplicationController def create @news = News.new(:project => @project, :author => User.current) - @news.attributes = params[:news] + @news.safe_attributes = params[:news] @news.save_attachments(params[:attachments]) if @news.save render_attachment_warning_if_needed(@news) @@ -83,8 +83,9 @@ class NewsController < ApplicationController end def update + @news.safe_attributes = params[:news] @news.save_attachments(params[:attachments]) - if @news.update_attributes(params[:news]) + if @news.save render_attachment_warning_if_needed(@news) flash[:notice] = l(:notice_successful_update) redirect_to :action => 'show', :id => @news diff --git a/app/models/news.rb b/app/models/news.rb index eed17945e..1f7c6f4a7 100644 --- a/app/models/news.rb +++ b/app/models/news.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class News < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project belongs_to :author, :class_name => 'User', :foreign_key => 'author_id' has_many :comments, :as => :commented, :dependent => :delete_all, :order => "created_on" @@ -38,6 +39,8 @@ class News < ActiveRecord::Base :conditions => Project.allowed_to_condition(args.shift || User.current, :view_news, *args) }} + safe_attributes 'title', 'summary', 'description' + def visible?(user=User.current) !user.nil? && user.allowed_to?(:view_news, project) end |