Prevent mass-assignment when adding a news comment (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9129 e93f8b46-1217-0410-a6f0-8f06a7374b81
2012-03-06 18:48:47 +00:00
parent 6aad82e524
commit bdf6e90f05
2 changed files with 5 additions and 1 deletions
@@ -25,7 +25,8 @@ class CommentsController < ApplicationController
  def create
    raise Unauthorized unless @news.commentable?

-    @comment = Comment.new(params[:comment])
+    @comment = Comment.new
+    @comment.safe_attributes = params[:comment]
    @comment.author = User.current
    if @news.comments << @comment
      flash[:notice] = l(:label_comment_added)