From 460239d1f9ee447fd9eafe208c9faadd65817e24 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Tue, 6 Mar 2012 18:59:32 +0000 Subject: [PATCH] Prevent mass-assignment when adding/updating an issue category (#10390). git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9131 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/issue_categories_controller.rb | 9 ++++++--- app/models/issue_category.rb | 3 ++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/app/controllers/issue_categories_controller.rb b/app/controllers/issue_categories_controller.rb index 7b63bc62b..4701142d0 100644 --- a/app/controllers/issue_categories_controller.rb +++ b/app/controllers/issue_categories_controller.rb @@ -39,11 +39,13 @@ class IssueCategoriesController < ApplicationController end def new - @category = @project.issue_categories.build(params[:issue_category]) + @category = @project.issue_categories.build + @category.safe_attributes = params[:issue_category] end def create - @category = @project.issue_categories.build(params[:issue_category]) + @category = @project.issue_categories.build + @category.safe_attributes = params[:issue_category] if @category.save respond_to do |format| format.html do @@ -73,7 +75,8 @@ class IssueCategoriesController < ApplicationController end def update - if @category.update_attributes(params[:issue_category]) + @category.safe_attributes = params[:issue_category] + if @category.save respond_to do |format| format.html { flash[:notice] = l(:notice_successful_update) diff --git a/app/models/issue_category.rb b/app/models/issue_category.rb index b05f58dd4..162e7dc72 100644 --- a/app/models/issue_category.rb +++ b/app/models/issue_category.rb @@ -16,6 +16,7 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. class IssueCategory < ActiveRecord::Base + include Redmine::SafeAttributes belongs_to :project belongs_to :assigned_to, :class_name => 'Principal', :foreign_key => 'assigned_to_id' has_many :issues, :foreign_key => 'category_id', :dependent => :nullify @@ -24,7 +25,7 @@ class IssueCategory < ActiveRecord::Base validates_uniqueness_of :name, :scope => [:project_id] validates_length_of :name, :maximum => 30 - attr_protected :project_id + safe_attributes 'name', 'assigned_to_id' named_scope :named, lambda {|arg| { :conditions => ["LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip]}}