Declare safe attributes for User and Projects models.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4492 e93f8b46-1217-0410-a6f0-8f06a7374b81
2010-12-12 13:19:07 +00:00
parent 3409333522
commit a4d7a99c22
6 changed files with 50 additions and 13 deletions
@@ -53,7 +53,7 @@ class MyController < ApplicationController
    @user = User.current
    @pref = @user.pref
    if request.post?
-      @user.attributes = params[:user]
+      @user.safe_attributes = params[:user]
      @user.mail_notification = params[:notification_option] || 'only_my_events'
      @user.pref.attributes = params[:pref]
      @user.pref[:no_self_notified] = (params[:no_self_notified] == '1')