dinislage/redmine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent mass-assignment when adding/updating a news (#10390).

Browse Source 
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9134 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2012-03-06 19:50:10 +00:00
parent 286bda14f1
commit d0356fe935
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/news_controller.rb
+3 -2
View File
@@ -68,7 +68,7 @@ class NewsController < ApplicationController
def create
@news = News.new(:project => @project, :author => User.current)
@news.attributes = params[:news]
@news.safe_attributes = params[:news]
@news.save_attachments(params[:attachments])
if @news.save
render_attachment_warning_if_needed(@news)
@@ -83,8 +83,9 @@ class NewsController < ApplicationController
end
def update
@news.safe_attributes = params[:news]
@news.save_attachments(params[:attachments])
if @news.update_attributes(params[:news])
if @news.save
render_attachment_warning_if_needed(@news)
flash[:notice] = l(:notice_successful_update)
redirect_to :action => 'show', :id => @news