Fixed: users should not be able to add relations with issues they're not allowed to view (#2589).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2323 e93f8b46-1217-0410-a6f0-8f06a7374b81
2009-01-27 19:33:03 +00:00
parent cd55529eaa
commit 10994e9027
3 changed files with 41 additions and 0 deletions
@@ -35,6 +35,8 @@ class IssueRelation < ActiveRecord::Base
  validates_numericality_of :delay, :allow_nil => true
  validates_uniqueness_of :issue_to_id, :scope => :issue_from_id
  
+  attr_protected :issue_from_id, :issue_to_id
+  
  def validate
    if issue_from && issue_to
      errors.add :issue_to_id, :activerecord_error_invalid if issue_from_id == issue_to_id