From 177ff05b97c5eda6adaf388aa660cc304d444fc9 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Wed, 7 Mar 2012 18:36:17 +0000
Subject: [PATCH] Merged r9138 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.3-stable@9154 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/controllers/wikis_controller.rb | 2 +-
 app/models/wiki.rb                  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/controllers/wikis_controller.rb b/app/controllers/wikis_controller.rb
index 523b80678..251b2a963 100644
--- a/app/controllers/wikis_controller.rb
+++ b/app/controllers/wikis_controller.rb
@@ -22,7 +22,7 @@ class WikisController < ApplicationController
   # Create or update a project's wiki
   def edit
     @wiki = @project.wiki || Wiki.new(:project => @project)
-    @wiki.attributes = params[:wiki]
+    @wiki.safe_attributes = params[:wiki]
     @wiki.save if request.post?
     render(:update) {|page| page.replace_html "tab-content-wiki", :partial => 'projects/settings/wiki'}
   end
diff --git a/app/models/wiki.rb b/app/models/wiki.rb
index 1b4301707..6cdfa246d 100644
--- a/app/models/wiki.rb
+++ b/app/models/wiki.rb
@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class Wiki < ActiveRecord::Base
+  include Redmine::SafeAttributes
   belongs_to :project
   has_many :pages, :class_name => 'WikiPage', :dependent => :destroy, :order => 'title'
   has_many :redirects, :class_name => 'WikiRedirect', :dependent => :delete_all
@@ -25,6 +26,8 @@ class Wiki < ActiveRecord::Base
   validates_presence_of :start_page
   validates_format_of :start_page, :with => /^[^,\.\/\?\;\|\:]*$/
 
+  safe_attributes 'start_page'
+
   def visible?(user=User.current)
     !user.nil? && user.allowed_to?(:view_wiki_pages, project)
   end