Prevent mass-assignment vulnerability when adding/updating an issue category (#922).
This commit is contained in:
parent
7505cb2ff0
commit
e77cb6133d
|
@ -23,7 +23,8 @@ class IssueCategoriesController < ApplicationController
|
||||||
verify :method => :post, :only => :destroy
|
verify :method => :post, :only => :destroy
|
||||||
|
|
||||||
def new
|
def new
|
||||||
@category = @project.issue_categories.build(params[:category])
|
@category = @project.issue_categories.build
|
||||||
|
@category.safe_attributes = params[:category]
|
||||||
if request.post?
|
if request.post?
|
||||||
if @category.save
|
if @category.save
|
||||||
respond_to do |format|
|
respond_to do |format|
|
||||||
|
@ -50,7 +51,8 @@ class IssueCategoriesController < ApplicationController
|
||||||
end
|
end
|
||||||
|
|
||||||
def edit
|
def edit
|
||||||
if request.post? and @category.update_attributes(params[:category])
|
@category.safe_attributes = params[:category]
|
||||||
|
if request.post? and @category.save
|
||||||
flash[:notice] = l(:notice_successful_update)
|
flash[:notice] = l(:notice_successful_update)
|
||||||
redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project
|
redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project
|
||||||
end
|
end
|
||||||
|
|
|
@ -13,6 +13,7 @@
|
||||||
#++
|
#++
|
||||||
|
|
||||||
class IssueCategory < ActiveRecord::Base
|
class IssueCategory < ActiveRecord::Base
|
||||||
|
include Redmine::SafeAttributes
|
||||||
belongs_to :project
|
belongs_to :project
|
||||||
belongs_to :assigned_to, :class_name => 'User', :foreign_key => 'assigned_to_id'
|
belongs_to :assigned_to, :class_name => 'User', :foreign_key => 'assigned_to_id'
|
||||||
has_many :issues, :foreign_key => 'category_id', :dependent => :nullify
|
has_many :issues, :foreign_key => 'category_id', :dependent => :nullify
|
||||||
|
@ -21,6 +22,8 @@ class IssueCategory < ActiveRecord::Base
|
||||||
validates_uniqueness_of :name, :scope => [:project_id]
|
validates_uniqueness_of :name, :scope => [:project_id]
|
||||||
validates_length_of :name, :maximum => 30
|
validates_length_of :name, :maximum => 30
|
||||||
|
|
||||||
|
safe_attributes 'name', 'assigned_to_id'
|
||||||
|
|
||||||
alias :destroy_without_reassign :destroy
|
alias :destroy_without_reassign :destroy
|
||||||
|
|
||||||
# Destroy the category
|
# Destroy the category
|
||||||
|
|
Loading…
Reference in New Issue