diff options
Diffstat (limited to 'app/controllers/messages_controller.rb')
| -rw-r--r-- | app/controllers/messages_controller.rb | 17 |
1 files changed, 6 insertions, 11 deletions
diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb index 6260cd1da..a8ef03f34 100644 --- a/app/controllers/messages_controller.rb +++ b/app/controllers/messages_controller.rb @@ -50,13 +50,10 @@ class MessagesController < ApplicationController # Create a new topic def new - @message = Message.new(params[:message]) + @message = Message.new @message.author = User.current @message.board = @board - if params[:message] && User.current.allowed_to?(:edit_messages, @project) - @message.locked = params[:message]['locked'] - @message.sticky = params[:message]['sticky'] - end + @message.safe_attributes = params[:message] if request.post? @message.save_attachments(params[:attachments]) if @message.save @@ -69,9 +66,10 @@ class MessagesController < ApplicationController # Reply to a topic def reply - @reply = Message.new(params[:reply]) + @reply = Message.new @reply.author = User.current @reply.board = @board + @reply.safe_attributes = params[:reply] @topic.children << @reply if !@reply.new_record? call_hook(:controller_messages_reply_after_save, { :params => params, :message => @reply}) @@ -84,11 +82,8 @@ class MessagesController < ApplicationController # Edit a message def edit (render_403; return false) unless @message.editable_by?(User.current) - if params[:message] - @message.locked = params[:message]['locked'] - @message.sticky = params[:message]['sticky'] - end - if request.post? && @message.update_attributes(params[:message]) + @message.safe_attributes = params[:message] + if request.post? && @message.save attachments = Attachment.attach_files(@message, params[:attachments]) render_attachment_warning_if_needed(@message) flash[:notice] = l(:notice_successful_update) |