kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use safe_attributes for issue watchers assignment. 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8197 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2011-12-13 19:50:44 +00:00
parent 4c469f9646
commit e1f885feda
2 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/issues_controller.rb
View File

@ -312,12 +312,8 @@ private
return false return false
end end
@issue.start_date ||= Date.today if Setting.default_issue_start_date_to_creation_date? @issue.start_date ||= Date.today if Setting.default_issue_start_date_to_creation_date?
if params[:issue].is_a?(Hash) @issue.safe_attributes = params[:issue]
@issue.safe_attributes = params[:issue]
if User.current.allowed_to?(:add_issue_watchers, @project) && @issue.new_record?
@issue.watcher_user_ids = params[:issue]['watcher_user_ids']
end
end
@priorities = IssuePriority.active @priorities = IssuePriority.active
@allowed_statuses = @issue.new_statuses_allowed_to(User.current, true) @allowed_statuses = @issue.new_statuses_allowed_to(User.current, true)
end end

6
app/models/issue.rb
View File

@ -282,6 +282,9 @@ class Issue < ActiveRecord::Base
'done_ratio', 'done_ratio',
:if => lambda {|issue, user| issue.new_statuses_allowed_to(user).any? } :if => lambda {|issue, user| issue.new_statuses_allowed_to(user).any? }
safe_attributes 'watcher_user_ids',
:if => lambda {|issue, user| issue.new_record? && user.allowed_to?(:add_issue_watchers, issue.project)}
safe_attributes 'is_private', safe_attributes 'is_private',
:if => lambda {|issue, user| :if => lambda {|issue, user|
user.allowed_to?(:set_issues_private, issue.project) || user.allowed_to?(:set_issues_private, issue.project) ||
@ -323,7 +326,8 @@ class Issue < ActiveRecord::Base
end end
end end
self.attributes = attrs # mass-assignment security bypass
self.send :attributes=, attrs, false
end end
def done_ratio def done_ratio