dinislage/redmine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent mass-assignment when adding/updating a version (#10390).

Browse Source 
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@9137 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2012-03-06 20:31:45 +00:00
parent 1ec2d98c14
commit fef2e4b672
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/versions_controller.rb
+5 -3
View File
@@ -73,7 +73,8 @@ class VersionsController < ApplicationController
end
def new
@version = @project.versions.build(params[:version])
@version = @project.versions.build
@version.safe_attributes = params[:version]
respond_to do |format|
format.html
@@ -92,7 +93,7 @@ class VersionsController < ApplicationController
if params[:version]
attributes = params[:version].dup
attributes.delete('sharing') unless attributes.nil? || @version.allowed_sharings.include?(attributes['sharing'])
@version.attributes = attributes
@version.safe_attributes = attributes
end
if request.post?
@@ -136,7 +137,8 @@ class VersionsController < ApplicationController
if request.put? && params[:version]
attributes = params[:version].dup
attributes.delete('sharing') unless @version.allowed_sharings.include?(attributes['sharing'])
if @version.update_attributes(attributes)
@version.safe_attributes = attributes
if @version.save
respond_to do |format|
format.html {
flash[:notice] = l(:notice_successful_update)