kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent mass-assignment when adding/updating an issue category (#10390). 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9131 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2012-03-06 18:59:32 +00:00
parent 809d35d34b
commit 460239d1f9
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/issue_categories_controller.rb
View File

@ -39,11 +39,13 @@ class IssueCategoriesController < ApplicationController
end end
def new def new
@category = @project.issue_categories.build(params[:issue_category]) @category = @project.issue_categories.build
@category.safe_attributes = params[:issue_category]
end end
def create def create
@category = @project.issue_categories.build(params[:issue_category]) @category = @project.issue_categories.build
@category.safe_attributes = params[:issue_category]
if @category.save if @category.save
respond_to do |format| respond_to do |format|
format.html do format.html do
@ -73,7 +75,8 @@ class IssueCategoriesController < ApplicationController
end end
def update def update
if @category.update_attributes(params[:issue_category]) @category.safe_attributes = params[:issue_category]
if @category.save
respond_to do |format| respond_to do |format|
format.html { format.html {
flash[:notice] = l(:notice_successful_update) flash[:notice] = l(:notice_successful_update)

3
app/models/issue_category.rb
View File

@ -16,6 +16,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class IssueCategory < ActiveRecord::Base class IssueCategory < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :project belongs_to :project
belongs_to :assigned_to, :class_name => 'Principal', :foreign_key => 'assigned_to_id' belongs_to :assigned_to, :class_name => 'Principal', :foreign_key => 'assigned_to_id'
has_many :issues, :foreign_key => 'category_id', :dependent => :nullify has_many :issues, :foreign_key => 'category_id', :dependent => :nullify
@ -24,7 +25,7 @@ class IssueCategory < ActiveRecord::Base
validates_uniqueness_of :name, :scope => [:project_id] validates_uniqueness_of :name, :scope => [:project_id]
validates_length_of :name, :maximum => 30 validates_length_of :name, :maximum => 30
attr_protected :project_id safe_attributes 'name', 'assigned_to_id'
named_scope :named, lambda {|arg| { :conditions => ["LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip]}} named_scope :named, lambda {|arg| { :conditions => ["LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip]}}