Prevent mass-assignment when adding a news comment (#10390).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9129 e93f8b46-1217-0410-a6f0-8f06a7374b81
2012-03-06 18:48:47 +00:00
parent 6aad82e524
commit bdf6e90f05
2 changed files with 5 additions and 1 deletions
@@ -16,8 +16,11 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

 class Comment < ActiveRecord::Base
+  include Redmine::SafeAttributes
  belongs_to :commented, :polymorphic => true, :counter_cache => true
  belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'

  validates_presence_of :commented, :author, :comments
+
+  safe_attributes 'comments'
 end