jro_apps/redmine Commit - r9013:286bda14f14d

Prevent mass-assignment when adding/updating a forum message (#10390)....

Jean-Philippe Lang -

r9013:286bda14f14d

parent child

Context file:

r9013:286bda14f14d

Collapse all files

app/controllers/messages_controller.rb +6 -11

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class MessagesController < ApplicationController
               menu_item :boards
               default_search_scope :messages
               before_filter :find_board, :only => [:new, :preview]
               before_filter :find_message, :except => [:new, :preview]
               before_filter :authorize, :except => [:preview, :edit, :destroy]
               helper :watchers
               helper :attachments
               include AttachmentsHelper
               REPLIES_PER_PAGE = 25 unless const_defined?(:REPLIES_PER_PAGE)
               # Show a topic and its replies
               def show
                 page = params[:page]
                 # Find the page of the requested reply
                 if params[:r] && page.nil?
                   offset = @topic.children.count(:conditions => ["#{Message.table_name}.id < ?", params[:r].to_i])
                   page = 1 + offset / REPLIES_PER_PAGE
                 end
                 @reply_count = @topic.children.count
                 @reply_pages = Paginator.new self, @reply_count, REPLIES_PER_PAGE, page
                 @replies =  @topic.children.find(:all, :include => [:author, :attachments, {:board => :project}],
                                                        :order => "#{Message.table_name}.created_on ASC",
                                                        :limit => @reply_pages.items_per_page,
                                                        :offset => @reply_pages.current.offset)
                 @reply = Message.new(:subject => "RE: #{@message.subject}")
                 render :action => "show", :layout => false if request.xhr?
               end
               # Create a new topic
               def new
-                @message = Message.new(params[:message])
+                @message = Message.new
                 @message.author = User.current
                 @message.board = @board
-                if params[:message] && User.current.allowed_to?(:edit_messages, @project)
+                @message.safe_attributes = params[:message]
-                  @message.locked = params[:message]['locked']
-                  @message.sticky = params[:message]['sticky']
-                end
                 if request.post?
                   @message.save_attachments(params[:attachments])
                   if @message.save
                     call_hook(:controller_messages_new_after_save, { :params => params, :message => @message})
                     render_attachment_warning_if_needed(@message)
                     redirect_to :action => 'show', :id => @message
                   end
                 end
               end
               # Reply to a topic
               def reply
-                @reply = Message.new(params[:reply])
+                @reply = Message.new
                 @reply.author = User.current
                 @reply.board = @board
+                @reply.safe_attributes = params[:reply]
                 @topic.children << @reply
                 if !@reply.new_record?
                   call_hook(:controller_messages_reply_after_save, { :params => params, :message => @reply})
                   attachments = Attachment.attach_files(@reply, params[:attachments])
                   render_attachment_warning_if_needed(@reply)
                 end
                 redirect_to :action => 'show', :id => @topic, :r => @reply
               end
               # Edit a message
               def edit
                 (render_403; return false) unless @message.editable_by?(User.current)
-                if params[:message]
+                @message.safe_attributes = params[:message]
-                  @message.locked = params[:message]['locked']
+                if request.post? && @message.save
-                  @message.sticky = params[:message]['sticky']
-                end
-                if request.post? && @message.update_attributes(params[:message])
                   attachments = Attachment.attach_files(@message, params[:attachments])
                   render_attachment_warning_if_needed(@message)
                   flash[:notice] = l(:notice_successful_update)
                   @message.reload
                   redirect_to :action => 'show', :board_id => @message.board, :id => @message.root, :r => (@message.parent_id && @message.id)
                 end
               end
               # Delete a messages
               def destroy
                 (render_403; return false) unless @message.destroyable_by?(User.current)
                 @message.destroy
                 redirect_to @message.parent.nil? ?
                   { :controller => 'boards', :action => 'show', :project_id => @project, :id => @board } :
                   { :action => 'show', :id => @message.parent, :r => @message }
               end
               def quote
                 user = @message.author
                 text = @message.content
                 subject = @message.subject.gsub('"', '\"')
                 subject = "RE: #{subject}" unless subject.starts_with?('RE:')
                 content = "#{ll(Setting.default_language, :text_user_wrote, user)}\\n> "
                 content << text.to_s.strip.gsub(%r{<pre>((.|\s)*?)</pre>}m, '[...]').gsub('"', '\"').gsub(/(\r?\n|\r\n?)/, "\\n> ") + "\\n\\n"
                 render(:update) { |page|
                   page << "$('message_subject').value = \"#{subject}\";"
                   page.<< "$('message_content').value = \"#{content}\";"
                   page.show 'reply'
                   page << "Form.Element.focus('message_content');"
                   page << "Element.scrollTo('reply');"
                   page << "$('message_content').scrollTop = $('message_content').scrollHeight - $('message_content').clientHeight;"
                 }
               end
               def preview
                 message = @board.messages.find_by_id(params[:id])
                 @attachements = message.attachments if message
                 @text = (params[:message] || params[:reply])[:content]
                 render :partial => 'common/preview'
               end
             private
               def find_message
                 find_board
                 @message = @board.messages.find(params[:id], :include => :parent)
                 @topic = @message.root
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_board
                 @board = Board.find(params[:board_id], :include => :project)
                 @project = @board.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/models/message.rb +7 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Message < ActiveRecord::Base
+              include Redmine::SafeAttributes
               belongs_to :board
               belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
               acts_as_tree :counter_cache => :replies_count, :order => "#{Message.table_name}.created_on ASC"
               acts_as_attachable
               belongs_to :last_reply, :class_name => 'Message', :foreign_key => 'last_reply_id'
               acts_as_searchable :columns => ['subject', 'content'],
                                  :include => {:board => :project},
                                  :project_key => "#{Board.table_name}.project_id",
                                  :date_column => "#{table_name}.created_on"
               acts_as_event :title => Proc.new {|o| "#{o.board.name}: #{o.subject}"},
                             :description => :content,
                             :type => Proc.new {|o| o.parent_id.nil? ? 'message' : 'reply'},
                             :url => Proc.new {|o| {:controller => 'messages', :action => 'show', :board_id => o.board_id}.merge(o.parent_id.nil? ? {:id => o.id} :
                                                                                                                                                    {:id => o.parent_id, :r => o.id, :anchor => "message-#{o.id}"})}
               acts_as_activity_provider :find_options => {:include => [{:board => :project}, :author]},
                                         :author_key => :author_id
               acts_as_watchable
               attr_protected :locked, :sticky
               validates_presence_of :board, :subject, :content
               validates_length_of :subject, :maximum => 255
               validate :cannot_reply_to_locked_topic, :on => :create
               after_create :add_author_as_watcher, :update_parent_last_reply
               after_update :update_messages_board
               after_destroy :reset_board_counters
               named_scope :visible, lambda {|*args| { :include => {:board => :project},
                                                       :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } }
+              safe_attributes 'subject', 'content'
+              safe_attributes 'locked', 'sticky',
+                :if => lambda {|message, user|
+                  user.allowed_to?(:edit_messages, message.project)
+                }
               def visible?(user=User.current)
                 !user.nil? && user.allowed_to?(:view_messages, project)
               end
               def cannot_reply_to_locked_topic
                 # Can not reply to a locked topic
                 errors.add :base, 'Topic is locked' if root.locked? && self != root
               end
               def update_parent_last_reply
                 if parent
                   parent.reload.update_attribute(:last_reply_id, self.id)
                 end
                 board.reset_counters!
               end
               def update_messages_board
                 if board_id_changed?
                   Message.update_all("board_id = #{board_id}", ["id = ? OR parent_id = ?", root.id, root.id])
                   Board.reset_counters!(board_id_was)
                   Board.reset_counters!(board_id)
                 end
               end
               def reset_board_counters
                 board.reset_counters!
               end
               def sticky=(arg)
                 write_attribute :sticky, (arg == true || arg.to_s == '1' ? 1 : 0)
               end
               def sticky?
                 sticky == 1
               end
               def project
                 board.project
               end
               def editable_by?(usr)
                 usr && usr.logged? && (usr.allowed_to?(:edit_messages, project) || (self.author == usr && usr.allowed_to?(:edit_own_messages, project)))
               end
               def destroyable_by?(usr)
                 usr && usr.logged? && (usr.allowed_to?(:delete_messages, project) || (self.author == usr && usr.allowed_to?(:delete_own_messages, project)))
               end
               private
               def add_author_as_watcher
                 Watcher.create(:watchable => self.root, :user => author)
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages