kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent mass-assignment when adding/updating a document (#10390). 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9130 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2012-03-06 18:54:41 +00:00
parent bdf6e90f05
commit 809d35d34b
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/documents_controller.rb
View File

@ -47,11 +47,13 @@ class DocumentsController < ApplicationController
end end
def new def new
@document = @project.documents.build(params[:document]) @document = @project.documents.build
@document.safe_attributes = params[:document]
end end
def create def create
@document = @project.documents.build(params[:document]) @document = @project.documents.build
@document.safe_attributes = params[:document]
@document.save_attachments(params[:attachments]) @document.save_attachments(params[:attachments])
if @document.save if @document.save
render_attachment_warning_if_needed(@document) render_attachment_warning_if_needed(@document)
@ -66,7 +68,8 @@ class DocumentsController < ApplicationController
end end
def update def update
if request.put? and @document.update_attributes(params[:document]) @document.safe_attributes = params[:document]
if request.put? and @document.save
flash[:notice] = l(:notice_successful_update) flash[:notice] = l(:notice_successful_update)
redirect_to :action => 'show', :id => @document redirect_to :action => 'show', :id => @document
else else

3
app/models/document.rb
View File

@ -16,6 +16,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class Document < ActiveRecord::Base class Document < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :project belongs_to :project
belongs_to :category, :class_name => "DocumentCategory", :foreign_key => "category_id" belongs_to :category, :class_name => "DocumentCategory", :foreign_key => "category_id"
acts_as_attachable :delete_permission => :manage_documents acts_as_attachable :delete_permission => :manage_documents
@ -32,6 +33,8 @@ class Document < ActiveRecord::Base
named_scope :visible, lambda {|*args| { :include => :project, named_scope :visible, lambda {|*args| { :include => :project,
:conditions => Project.allowed_to_condition(args.shift || User.current, :view_documents, *args) } } :conditions => Project.allowed_to_condition(args.shift || User.current, :view_documents, *args) } }
safe_attributes 'category_id', 'title', 'description'
def visible?(user=User.current) def visible?(user=User.current)
!user.nil? && user.allowed_to?(:view_documents, project) !user.nil? && user.allowed_to?(:view_documents, project)
end end