Use safe_attributes= just like in #create. (#922)

2012-03-06 19:52:10 +00:00 · 2012-03-06 19:52:10 +00:00 · 5de377c5ee
commit 5de377c5ee
parent 305df19ab7
1 changed files with 2 additions and 1 deletions
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@ -59,7 +59,8 @@ class ProjectsController < ApplicationController
  def new
    @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
    @trackers = Tracker.all
-    @project = Project.new(params[:project])
+    @project = Project.new
+    @project.safe_attributes = params[:project]
  end

  verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }