From 1ec2d98c14bd4ba8291c236438f97a30bf2109f3 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Tue, 6 Mar 2012 20:23:00 +0000 Subject: Prevent mass-assignment when adding/updating a time entry (#10390). git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9136 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/timelog_controller.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'app/controllers') diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb index d6d1911e7..4ae4aa277 100644 --- a/app/controllers/timelog_controller.rb +++ b/app/controllers/timelog_controller.rb @@ -118,12 +118,12 @@ class TimelogController < ApplicationController def new @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today) - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] end def create @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today) - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry }) @@ -152,11 +152,11 @@ class TimelogController < ApplicationController end def edit - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] end def update - @time_entry.attributes = params[:time_entry] + @time_entry.safe_attributes = params[:time_entry] call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry }) @@ -187,7 +187,7 @@ class TimelogController < ApplicationController unsaved_time_entry_ids = [] @time_entries.each do |time_entry| time_entry.reload - time_entry.attributes = attributes + time_entry.safe_attributes = attributes call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry }) unless time_entry.save # Keep unsaved time_entry ids to display them in flash error -- cgit v1.2.3