Prevent mass-assignment when adding/updating an issue category (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9131 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/issue_categories_controller.rb

@@ -39,11 +39,13 @@ class IssueCategoriesController < ApplicationController
   end
 
   def new
-    @category = @project.issue_categories.build(params[:issue_category])
+    @category = @project.issue_categories.build
+    @category.safe_attributes = params[:issue_category]
   end
 
   def create
-    @category = @project.issue_categories.build(params[:issue_category])
+    @category = @project.issue_categories.build
+    @category.safe_attributes = params[:issue_category]
     if @category.save
       respond_to do |format|
         format.html do
@@ -73,7 +75,8 @@ class IssueCategoriesController < ApplicationController
   end
 
   def update
-    if @category.update_attributes(params[:issue_category])
+    @category.safe_attributes = params[:issue_category]
+    if @category.save
       respond_to do |format|
         format.html {
           flash[:notice] = l(:notice_successful_update)

app/models/issue_category.rb

@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class IssueCategory < ActiveRecord::Base
+  include Redmine::SafeAttributes
   belongs_to :project
   belongs_to :assigned_to, :class_name => 'Principal', :foreign_key => 'assigned_to_id'
   has_many :issues, :foreign_key => 'category_id', :dependent => :nullify
@@ -24,7 +25,7 @@ class IssueCategory < ActiveRecord::Base
   validates_uniqueness_of :name, :scope => [:project_id]
   validates_length_of :name, :maximum => 30
   
-  attr_protected :project_id
+  safe_attributes 'name', 'assigned_to_id'
 
   named_scope :named, lambda {|arg| { :conditions => ["LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip]}}