Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-03 11:56:18 +01:00
Code Issues Packages Projects Releases Activity

Use safe_attributes for custom field enumerations.

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@15690 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2016-07-17 07:27:23 +00:00
parent 316eae078c
commit cf22053dd5
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/custom_field_enumerations_controller.rb
View File

@@ -29,7 +29,8 @@ class CustomFieldEnumerationsController < ApplicationController
end end
def create def create
@value = @custom_field.enumerations.build(params[:custom_field_enumeration]) @value = @custom_field.enumerations.build
@value.safe_attributes = params[:custom_field_enumeration]
@value.save @value.save
respond_to do |format| respond_to do |format|
format.html { redirect_to custom_field_enumerations_path(@custom_field) } format.html { redirect_to custom_field_enumerations_path(@custom_field) }
@@ -38,7 +39,10 @@ class CustomFieldEnumerationsController < ApplicationController
end end
def update_each def update_each
if CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations]) saved = CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations]) do |enumeration, enumeration_attributes|
enumeration.safe_attributes = enumeration_attributes
end
if saved
flash[:notice] = l(:notice_successful_update) flash[:notice] = l(:notice_successful_update)
end end
redirect_to :action => 'index' redirect_to :action => 'index'

10
app/models/custom_field_enumeration.rb
View File

@@ -16,6 +16,8 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class CustomFieldEnumeration < ActiveRecord::Base class CustomFieldEnumeration < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :custom_field belongs_to :custom_field
attr_accessible :name, :active, :position attr_accessible :name, :active, :position
@@ -26,6 +28,10 @@ class CustomFieldEnumeration < ActiveRecord::Base
scope :active, lambda { where(:active => true) } scope :active, lambda { where(:active => true) }
safe_attributes 'name',
'active',
'position'
def to_s def to_s
name.to_s name.to_s
end end
@@ -56,7 +62,11 @@ class CustomFieldEnumeration < ActiveRecord::Base
attributes.each do |enumeration_id, enumeration_attributes| attributes.each do |enumeration_id, enumeration_attributes|
enumeration = custom_field.enumerations.find_by_id(enumeration_id) enumeration = custom_field.enumerations.find_by_id(enumeration_id)
if enumeration if enumeration
if block_given?
yield enumeration, enumeration_attributes
else
enumeration.attributes = enumeration_attributes enumeration.attributes = enumeration_attributes
end
unless enumeration.save unless enumeration.save
raise ActiveRecord::Rollback raise ActiveRecord::Rollback
end end