kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent mass-assignment when adding/updating a forum (#10390). 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9140 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2012-03-06 21:36:28 +00:00
parent 87356648f6
commit 2bcf9f2871
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/boards_controller.rb
View File

@ -60,11 +60,13 @@ class BoardsController < ApplicationController
end end
def new def new
@board = @project.boards.build(params[:board]) @board = @project.boards.build
@board.safe_attributes = params[:board]
end end
def create def create
@board = @project.boards.build(params[:board]) @board = @project.boards.build
@board.safe_attributes = params[:board]
if @board.save if @board.save
flash[:notice] = l(:notice_successful_create) flash[:notice] = l(:notice_successful_create)
redirect_to_settings_in_projects redirect_to_settings_in_projects
@ -77,7 +79,8 @@ class BoardsController < ApplicationController
end end
def update def update
if @board.update_attributes(params[:board]) @board.safe_attributes = params[:board]
if @board.save
redirect_to_settings_in_projects redirect_to_settings_in_projects
else else
render :action => 'edit' render :action => 'edit'

3
app/models/board.rb
View File

@ -16,6 +16,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class Board < ActiveRecord::Base class Board < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :project belongs_to :project
has_many :topics, :class_name => 'Message', :conditions => "#{Message.table_name}.parent_id IS NULL", :order => "#{Message.table_name}.created_on DESC" has_many :topics, :class_name => 'Message', :conditions => "#{Message.table_name}.parent_id IS NULL", :order => "#{Message.table_name}.created_on DESC"
has_many :messages, :dependent => :destroy, :order => "#{Message.table_name}.created_on DESC" has_many :messages, :dependent => :destroy, :order => "#{Message.table_name}.created_on DESC"
@ -30,6 +31,8 @@ class Board < ActiveRecord::Base
named_scope :visible, lambda {|*args| { :include => :project, named_scope :visible, lambda {|*args| { :include => :project,
:conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } } :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } }
safe_attributes 'name', 'description', 'move_to'
def visible?(user=User.current) def visible?(user=User.current)
!user.nil? && user.allowed_to?(:view_messages, project) !user.nil? && user.allowed_to?(:view_messages, project)
end end

8
test/functional/boards_controller_test.rb
View File

@ -122,6 +122,14 @@ class BoardsControllerTest < ActionController::TestCase
assert_equal 'Testing', Board.find(2).name assert_equal 'Testing', Board.find(2).name
end end
def test_update_position
@request.session[:user_id] = 2
put :update, :project_id => 1, :id => 2, :board => { :move_to => 'highest'}
assert_redirected_to '/projects/ecookbook/settings/boards'
board = Board.find(2)
assert_equal 1, board.position
end
def test_update_with_failure def test_update_with_failure
@request.session[:user_id] = 2 @request.session[:user_id] = 2
put :update, :project_id => 1, :id => 2, :board => { :name => '', :description => 'Testing board update'} put :update, :project_id => 1, :id => 2, :board => { :name => '', :description => 'Testing board update'}