Prevent mass-assignment when adding/updating a time entry (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9136 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/models/time_entry.rb

@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class TimeEntry < ActiveRecord::Base
+  include Redmine::SafeAttributes
   # could have used polymorphic association
   # project association here allows easy loading of time entries at project level with one database trip
   belongs_to :project
@@ -65,6 +66,8 @@ class TimeEntry < ActiveRecord::Base
     end
   }
 
+  safe_attributes 'hours', 'comments', 'issue_id', 'activity_id', 'spent_on', 'custom_field_values'
+
   def initialize(attributes=nil, *args)
     super
     if new_record? && self.activity.nil?