Use safe_attributes for custom field enumerations.

git-svn-id: http://svn.redmine.org/redmine/trunk@15690 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/custom_field_enumerations_controller.rb

@@ -29,7 +29,8 @@ class CustomFieldEnumerationsController < ApplicationController
   end
 
   def create
-    @value = @custom_field.enumerations.build(params[:custom_field_enumeration])
+    @value = @custom_field.enumerations.build
+    @value.safe_attributes = params[:custom_field_enumeration]
     @value.save
     respond_to do |format|
       format.html { redirect_to custom_field_enumerations_path(@custom_field) }
@@ -38,7 +39,10 @@ class CustomFieldEnumerationsController < ApplicationController
   end
 
   def update_each
-    if CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations])
+    saved = CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations]) do |enumeration, enumeration_attributes|
+      enumeration.safe_attributes = enumeration_attributes
+    end
+    if saved
       flash[:notice] = l(:notice_successful_update)
     end
     redirect_to :action => 'index'

app/models/custom_field_enumeration.rb

@@ -16,6 +16,8 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class CustomFieldEnumeration < ActiveRecord::Base
+  include Redmine::SafeAttributes
+
   belongs_to :custom_field
   attr_accessible :name, :active, :position
 
@@ -26,6 +28,10 @@ class CustomFieldEnumeration < ActiveRecord::Base
 
   scope :active, lambda { where(:active => true) }
 
+  safe_attributes 'name',
+    'active',
+    'position'
+
   def to_s
     name.to_s
   end
@@ -56,7 +62,11 @@ class CustomFieldEnumeration < ActiveRecord::Base
       attributes.each do |enumeration_id, enumeration_attributes|
         enumeration = custom_field.enumerations.find_by_id(enumeration_id)
         if enumeration
+          if block_given?
+            yield enumeration, enumeration_attributes
+          else
             enumeration.attributes = enumeration_attributes
+          end
           unless enumeration.save
             raise ActiveRecord::Rollback
           end