diff options
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/users_controller.rb | 1 | ||||
| -rw-r--r-- | app/models/user.rb | 5 |
2 files changed, 4 insertions, 2 deletions
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 85749920b..c3c63d736 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -145,7 +145,6 @@ class UsersController < ApplicationController if params[:user][:password].present? && (@user.auth_source_id.nil? || params[:user][:auth_source_id].blank?) @user.password, @user.password_confirmation = params[:user][:password], params[:user][:password_confirmation] end - @user.group_ids = params[:user][:group_ids] if params[:user][:group_ids] @user.safe_attributes = params[:user] # Was the account actived ? (do it before User#save clears the change) was_activated = (@user.status_change == [User::STATUS_REGISTERED, User::STATUS_ACTIVE]) diff --git a/app/models/user.rb b/app/models/user.rb index f69604199..91d6c5fd0 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -60,7 +60,7 @@ class User < Principal attr_accessor :password, :password_confirmation attr_accessor :last_before_login_on # Prevents unauthorized assignments - attr_protected :login, :admin, :password, :password_confirmation, :hashed_password, :group_ids + attr_protected :login, :admin, :password, :password_confirmation, :hashed_password validates_presence_of :login, :firstname, :lastname, :mail, :if => Proc.new { |user| !user.is_a?(AnonymousUser) } validates_uniqueness_of :login, :if => Proc.new { |user| !user.login.blank? }, :case_sensitive => false @@ -407,6 +407,9 @@ class User < Principal 'auth_source_id', :if => lambda {|user, current_user| current_user.admin?} + safe_attributes 'group_ids', + :if => lambda {|user, current_user| current_user.admin? && !user.new_record?} + # Utility method to help check if a user should be notified about an # event. # |