kolan
/
obsolete.ChilliProject
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prevent mass-assignment vulnerability when adding/updating an issue category (#922).

This commit is contained in:
Jean-Philippe Lang 2012-03-06 18:59:32 +00:00 committed by Holger Just
parent c651ba1a98
commit 296b3173ef
3 changed files with 10 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
app/controllers/documents_controller.rb
View File

@ -43,28 +43,13 @@ class DocumentsController < ApplicationController
end end
def new def new
<<<<<<< HEAD @document = @project.documents.build
@document = @project.documents.build(params[:document]) @document.safe_attributes = params[:document]
if request.post? and @document.save if request.post? && @document.save
attachments = Attachment.attach_files(@document, params[:attachments]) attachments = Attachment.attach_files(@document, params[:attachments])
render_attachment_warning_if_needed(@document) render_attachment_warning_if_needed(@document)
flash[:notice] = l(:notice_successful_create) flash[:notice] = l(:notice_successful_create)
redirect_to :action => 'index', :project_id => @project redirect_to :action => 'index', :project_id => @project
=======
@document = @project.documents.build
@document.safe_attributes = params[:document]
if request.post?
if User.current.allowed_to?(:add_document_watchers, @project) && params[:document]['watcher_user_ids'].present?
@document.watcher_user_ids = params[:document]['watcher_user_ids']
end
if @document.save
attachments = Attachment.attach_files(@document, params[:attachments])
render_attachment_warning_if_needed(@document)
flash[:notice] = l(:notice_successful_create)
redirect_to :action => 'index', :project_id => @project
end
>>>>>>> edaf457... Prevent mass-assignment vulnerability when adding/updating a document (#922).
end end
end end

6
app/controllers/issue_categories_controller.rb
View File

@ -23,7 +23,8 @@ class IssueCategoriesController < ApplicationController
verify :method => :post, :only => :destroy verify :method => :post, :only => :destroy
def new def new
@category = @project.issue_categories.build(params[:category]) @category = @project.issue_categories.build
@category.safe_attributes = params[:category]
if request.post? if request.post?
if @category.save if @category.save
respond_to do |format| respond_to do |format|
@ -50,7 +51,8 @@ class IssueCategoriesController < ApplicationController
end end
def edit def edit
if request.post? and @category.update_attributes(params[:category]) @category.safe_attributes = params[:category]
if request.post? and @category.save
flash[:notice] = l(:notice_successful_update) flash[:notice] = l(:notice_successful_update)
redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project
end end

3
app/models/issue_category.rb
View File

@ -13,6 +13,7 @@
#++ #++
class IssueCategory < ActiveRecord::Base class IssueCategory < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :project belongs_to :project
belongs_to :assigned_to, :class_name => 'User', :foreign_key => 'assigned_to_id' belongs_to :assigned_to, :class_name => 'User', :foreign_key => 'assigned_to_id'
has_many :issues, :foreign_key => 'category_id', :dependent => :nullify has_many :issues, :foreign_key => 'category_id', :dependent => :nullify
@ -21,6 +22,8 @@ class IssueCategory < ActiveRecord::Base
validates_uniqueness_of :name, :scope => [:project_id] validates_uniqueness_of :name, :scope => [:project_id]
validates_length_of :name, :maximum => 30 validates_length_of :name, :maximum => 30
safe_attributes 'name', 'assigned_to_id'
alias :destroy_without_reassign :destroy alias :destroy_without_reassign :destroy
# Destroy the category # Destroy the category