jro_apps/redmine Commit - r9016:1ec2d98c14bd

Prevent mass-assignment when adding/updating a time entry (#10390)....

Jean-Philippe Lang -

r9016:1ec2d98c14bd

parent child

Context file:

r9016:1ec2d98c14bd

Collapse all files

app/controllers/timelog_controller.rb +5 -5

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TimelogController < ApplicationController
               menu_item :issues
               before_filter :find_project, :only => [:create]
               before_filter :find_time_entry, :only => [:show, :edit, :update]
               before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]
               before_filter :authorize, :except => [:new, :index, :report]
               before_filter :find_optional_project, :only => [:new, :index, :report]
               before_filter :authorize_global, :only => [:new, :index, :report]
               accept_rss_auth :index
               accept_api_auth :index, :show, :create, :update, :destroy
               helper :sort
               include SortHelper
               helper :issues
               include TimelogHelper
               helper :custom_fields
               include CustomFieldsHelper
               def index
                 sort_init 'spent_on', 'desc'
                 sort_update 'spent_on' => 'spent_on',
                             'user' => 'user_id',
                             'activity' => 'activity_id',
                             'project' => "#{Project.table_name}.name",
                             'issue' => 'issue_id',
                             'hours' => 'hours'
                 retrieve_date_range
                 scope = TimeEntry.visible.spent_between(@from, @to)
                 if @issue
                   scope = scope.on_issue(@issue)
                 elsif @project
                   scope = scope.on_project(@project, Setting.display_subprojects_issues?)
                 end
                 respond_to do |format|
                   format.html {
                     # Paginate results
                     @entry_count = scope.count
                     @entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']
                     @entries = scope.all(
                       :include => [:project, :activity, :user, {:issue => :tracker}],
                       :order => sort_clause,
                       :limit  =>  @entry_pages.items_per_page,
                       :offset =>  @entry_pages.current.offset
                     )
                     @total_hours = scope.sum(:hours).to_f
                     render :layout => !request.xhr?
                   }
                   format.api  {
                     @entry_count = scope.count
                     @offset, @limit = api_offset_and_limit
                     @entries = scope.all(
                       :include => [:project, :activity, :user, {:issue => :tracker}],
                       :order => sort_clause,
                       :limit  => @limit,
                       :offset => @offset
                     )
                   }
                   format.atom {
                     entries = scope.all(
                       :include => [:project, :activity, :user, {:issue => :tracker}],
                       :order => "#{TimeEntry.table_name}.created_on DESC",
                       :limit => Setting.feeds_limit.to_i
                     )
                     render_feed(entries, :title => l(:label_spent_time))
                   }
                   format.csv {
                     # Export all entries
                     @entries = scope.all(
                       :include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],
                       :order => sort_clause
                     )
                     send_data(entries_to_csv(@entries), :type => 'text/csv; header=present', :filename => 'timelog.csv')
                   }
                 end
               end
               def report
                 retrieve_date_range
                 @report = Redmine::Helpers::TimeReport.new(@project, @issue, params[:criteria], params[:columns], @from, @to)
                 respond_to do |format|
                   format.html { render :layout => !request.xhr? }
                   format.csv  { send_data(report_to_csv(@report), :type => 'text/csv; header=present', :filename => 'timelog.csv') }
                 end
               end
               def show
                 respond_to do |format|
                   # TODO: Implement html response
                   format.html { render :nothing => true, :status => 406 }
                   format.api
                 end
               end
               def new
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
               end
               def create
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                 if @time_entry.save
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_create)
                       if params[:continue]
                         if params[:project_id]
                           redirect_to :action => 'new', :project_id => @time_entry.project, :issue_id => @time_entry.issue, :back_url => params[:back_url]
                         else
                           redirect_to :action => 'new', :back_url => params[:back_url]
                         end
                       else
                         redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                       end
                     }
                     format.api  { render :action => 'show', :status => :created, :location => time_entry_url(@time_entry) }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'new' }
                     format.api  { render_validation_errors(@time_entry) }
                   end
                 end
               end
               def edit
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
               end
               def update
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                 if @time_entry.save
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_update)
                       redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                     }
                     format.api  { head :ok }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'edit' }
                     format.api  { render_validation_errors(@time_entry) }
                   end
                 end
               end
               def bulk_edit
                 @available_activities = TimeEntryActivity.shared.active
                 @custom_fields = TimeEntry.first.available_custom_fields
               end
               def bulk_update
                 attributes = parse_params_for_bulk_time_entry_attributes(params)
                 unsaved_time_entry_ids = []
                 @time_entries.each do |time_entry|
                   time_entry.reload
-                  time_entry.attributes = attributes
+                  time_entry.safe_attributes = attributes
                   call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry })
                   unless time_entry.save
                     # Keep unsaved time_entry ids to display them in flash error
                     unsaved_time_entry_ids << time_entry.id
                   end
                 end
                 set_flash_from_bulk_time_entry_save(@time_entries, unsaved_time_entry_ids)
                 redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})
               end
               def destroy
                 destroyed = TimeEntry.transaction do
                   @time_entries.each do |t|
                     unless t.destroy && t.destroyed?
                       raise ActiveRecord::Rollback
                     end
                   end
                 end
                 respond_to do |format|
                   format.html {
                     if destroyed
                       flash[:notice] = l(:notice_successful_delete)
                     else
                       flash[:error] = l(:notice_unable_delete_time_entry)
                     end
                     redirect_back_or_default(:action => 'index', :project_id => @projects.first)
                   }
                   format.api  {
                     if destroyed
                       head :ok
                     else
                       render_validation_errors(@time_entries)
                     end
                   }
                 end
               end
             private
               def find_time_entry
                 @time_entry = TimeEntry.find(params[:id])
                 unless @time_entry.editable_by?(User.current)
                   render_403
                   return false
                 end
                 @project = @time_entry.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_time_entries
                 @time_entries = TimeEntry.find_all_by_id(params[:id] || params[:ids])
                 raise ActiveRecord::RecordNotFound if @time_entries.empty?
                 @projects = @time_entries.collect(&:project).compact.uniq
                 @project = @projects.first if @projects.size == 1
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def set_flash_from_bulk_time_entry_save(time_entries, unsaved_time_entry_ids)
                 if unsaved_time_entry_ids.empty?
                   flash[:notice] = l(:notice_successful_update) unless time_entries.empty?
                 else
                   flash[:error] = l(:notice_failed_to_save_time_entries,
                                     :count => unsaved_time_entry_ids.size,
                                     :total => time_entries.size,
                                     :ids => '#' + unsaved_time_entry_ids.join(', #'))
                 end
               end
               def find_project
                 if (project_id = (params[:project_id] || params[:time_entry] && params[:time_entry][:project_id])).present?
                   @project = Project.find(project_id)
                 end
                 if (issue_id = (params[:issue_id] || params[:time_entry] && params[:time_entry][:issue_id])).present?
                   @issue = Issue.find(issue_id)
                   @project ||= @issue.project
                 end
                 if @project.nil?
                   render_404
                   return false
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_optional_project
                 if !params[:issue_id].blank?
                   @issue = Issue.find(params[:issue_id])
                   @project = @issue.project
                 elsif !params[:project_id].blank?
                   @project = Project.find(params[:project_id])
                 end
               end
               # Retrieves the date range based on predefined ranges or specific from/to param dates
               def retrieve_date_range
                 @free_period = false
                 @from, @to = nil, nil
                 if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)
                   case params[:period].to_s
                   when 'today'
                     @from = @to = Date.today
                   when 'yesterday'
                     @from = @to = Date.today - 1
                   when 'current_week'
                     @from = Date.today - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when 'last_week'
                     @from = Date.today - 7 - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when '7_days'
                     @from = Date.today - 7
                     @to = Date.today
                   when 'current_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1)
                     @to = (@from >> 1) - 1
                   when 'last_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1) << 1
                     @to = (@from >> 1) - 1
                   when '30_days'
                     @from = Date.today - 30
                     @to = Date.today
                   when 'current_year'
                     @from = Date.civil(Date.today.year, 1, 1)
                     @to = Date.civil(Date.today.year, 12, 31)
                   end
                 elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))
                   begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end
                   begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end
                   @free_period = true
                 else
                   # default
                 end
                 @from, @to = @to, @from if @from && @to && @from > @to
               end
               def parse_params_for_bulk_time_entry_attributes(params)
                 attributes = (params[:time_entry] || {}).reject {|k,v| v.blank?}
                 attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}
                 attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]
                 attributes
               end
             end

app/models/time_entry.rb +3 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TimeEntry < ActiveRecord::Base
+              include Redmine::SafeAttributes
               # could have used polymorphic association
               # project association here allows easy loading of time entries at project level with one database trip
               belongs_to :project
               belongs_to :issue
               belongs_to :user
               belongs_to :activity, :class_name => 'TimeEntryActivity', :foreign_key => 'activity_id'
               attr_protected :project_id, :user_id, :tyear, :tmonth, :tweek
               acts_as_customizable
               acts_as_event :title => Proc.new {|o| "#{l_hours(o.hours)} (#{(o.issue || o.project).event_title})"},
                             :url => Proc.new {|o| {:controller => 'timelog', :action => 'index', :project_id => o.project, :issue_id => o.issue}},
                             :author => :user,
                             :description => :comments
               acts_as_activity_provider :timestamp => "#{table_name}.created_on",
                                         :author_key => :user_id,
                                         :find_options => {:include => :project}
               validates_presence_of :user_id, :activity_id, :project_id, :hours, :spent_on
               validates_numericality_of :hours, :allow_nil => true, :message => :invalid
               validates_length_of :comments, :maximum => 255, :allow_nil => true
               before_validation :set_project_if_nil
               validate :validate_time_entry
               named_scope :visible, lambda {|*args| {
                 :include => :project,
                 :conditions => Project.allowed_to_condition(args.shift || User.current, :view_time_entries, *args)
               }}
               named_scope :on_issue, lambda {|issue| {
                 :include => :issue,
                 :conditions => "#{Issue.table_name}.root_id = #{issue.root_id} AND #{Issue.table_name}.lft >= #{issue.lft} AND #{Issue.table_name}.rgt <= #{issue.rgt}"
               }}
               named_scope :on_project, lambda {|project, include_subprojects| {
                 :include => :project,
                 :conditions => project.project_condition(include_subprojects)
               }}
               named_scope :spent_between, lambda {|from, to|
                 if from && to
                  {:conditions => ["#{TimeEntry.table_name}.spent_on BETWEEN ? AND ?", from, to]}
                 elsif from
                  {:conditions => ["#{TimeEntry.table_name}.spent_on >= ?", from]}
                 elsif to
                  {:conditions => ["#{TimeEntry.table_name}.spent_on <= ?", to]}
                 else
                  {}
                 end
               }
+              safe_attributes 'hours', 'comments', 'issue_id', 'activity_id', 'spent_on', 'custom_field_values'
               def initialize(attributes=nil, *args)
                 super
                 if new_record? && self.activity.nil?
                   if default_activity = TimeEntryActivity.default
                     self.activity_id = default_activity.id
                   end
                   self.hours = nil if hours == 0
                 end
               end
               def set_project_if_nil
                 self.project = issue.project if issue && project.nil?
               end
               def validate_time_entry
                 errors.add :hours, :invalid if hours && (hours < 0 || hours >= 1000)
                 errors.add :project_id, :invalid if project.nil?
                 errors.add :issue_id, :invalid if (issue_id && !issue) || (issue && project!=issue.project)
               end
               def hours=(h)
                 write_attribute :hours, (h.is_a?(String) ? (h.to_hours || h) : h)
               end
               def hours
                 h = read_attribute(:hours)
                 if h.is_a?(Float)
                   h.round(2)
                 else
                   h
                 end
               end
               # tyear, tmonth, tweek assigned where setting spent_on attributes
               # these attributes make time aggregations easier
               def spent_on=(date)
                 super
                 if spent_on.is_a?(Time)
                   self.spent_on = spent_on.to_date
                 end
                 self.tyear = spent_on ? spent_on.year : nil
                 self.tmonth = spent_on ? spent_on.month : nil
                 self.tweek = spent_on ? Date.civil(spent_on.year, spent_on.month, spent_on.day).cweek : nil
               end
               # Returns true if the time entry can be edited by usr, otherwise false
               def editable_by?(usr)
                 (usr == user && usr.allowed_to?(:edit_own_time_entries, project)) || usr.allowed_to?(:edit_time_entries, project)
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages