diff options
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/timelog_controller.rb | 10 | ||||
| -rw-r--r-- | app/models/time_entry.rb | 3 |
2 files changed, 8 insertions, 5 deletions
diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb index d6d1911e7..4ae4aa277 100644 --- a/app/controllers/timelog_controller.rb +++ b/app/controllers/timelog_controller.rb @@ -118,12 +118,12 @@ class TimelogController < ApplicationController def new @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today) - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] end def create @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today) - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry }) @@ -152,11 +152,11 @@ class TimelogController < ApplicationController end def edit - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] end def update - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry }) @@ -187,7 +187,7 @@ class TimelogController < ApplicationController unsaved_time_entry_ids = [] @time_entries.each do |time_entry| time_entry.reload - time_entry.attributes = attributes + time_entry.safe_attributes = attributes call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry }) unless time_entry.save # Keep unsaved time_entry ids to display them in flash error diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb index 9266eb86f..6dbf78413 100644 --- a/app/models/time_entry.rb +++ b/app/models/time_entry.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class TimeEntry < ActiveRecord::Base + include Redmine::SafeAttributes # could have used polymorphic association # project association here allows easy loading of time entries at project level with one database trip belongs_to :project @@ -65,6 +66,8 @@ class TimeEntry < ActiveRecord::Base end } + safe_attributes 'hours', 'comments', 'issue_id', 'activity_id', 'spent_on', 'custom_field_values' + def initialize(attributes=nil, *args) super if new_record? && self.activity.nil? |