##// END OF EJS Templates
jro_apps » redmine
RSS
Prevent mass-assignment when adding/updating a forum message (#10390)....
Jean-Philippe Lang -
r9013:286bda14f14d
parent child
Show More
Side by Side Unified
Context file:
r9013:286bda14f14d Loading diff...:
Show file before | Show file after | Hide comments
@@ -1,148 +1,143
1 1 # Redmine - project management software
2 2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 class MessagesController < ApplicationController
19 19 menu_item :boards
20 20 default_search_scope :messages
21 21 before_filter :find_board, :only => [:new, :preview]
22 22 before_filter :find_message, :except => [:new, :preview]
23 23 before_filter :authorize, :except => [:preview, :edit, :destroy]
24 24
25 25 helper :watchers
26 26 helper :attachments
27 27 include AttachmentsHelper
28 28
29 29 REPLIES_PER_PAGE = 25 unless const_defined?(:REPLIES_PER_PAGE)
30 30
31 31 # Show a topic and its replies
32 32 def show
33 33 page = params[:page]
34 34 # Find the page of the requested reply
35 35 if params[:r] && page.nil?
36 36 offset = @topic.children.count(:conditions => ["#{Message.table_name}.id < ?", params[:r].to_i])
37 37 page = 1 + offset / REPLIES_PER_PAGE
38 38 end
39 39
40 40 @reply_count = @topic.children.count
41 41 @reply_pages = Paginator.new self, @reply_count, REPLIES_PER_PAGE, page
42 42 @replies = @topic.children.find(:all, :include => [:author, :attachments, {:board => :project}],
43 43 :order => "#{Message.table_name}.created_on ASC",
44 44 :limit => @reply_pages.items_per_page,
45 45 :offset => @reply_pages.current.offset)
46 46
47 47 @reply = Message.new(:subject => "RE: #{@message.subject}")
48 48 render :action => "show", :layout => false if request.xhr?
49 49 end
50 50
51 51 # Create a new topic
52 52 def new
53 @message = Message.new(params[:message])
53 @message = Message.new
54 54 @message.author = User.current
55 55 @message.board = @board
56 if params[:message] && User.current.allowed_to?(:edit_messages, @project)
57 @message.locked = params[:message]['locked']
58 @message.sticky = params[:message]['sticky']
59 end
56 @message.safe_attributes = params[:message]
60 57 if request.post?
61 58 @message.save_attachments(params[:attachments])
62 59 if @message.save
63 60 call_hook(:controller_messages_new_after_save, { :params => params, :message => @message})
64 61 render_attachment_warning_if_needed(@message)
65 62 redirect_to :action => 'show', :id => @message
66 63 end
67 64 end
68 65 end
69 66
70 67 # Reply to a topic
71 68 def reply
72 @reply = Message.new(params[:reply])
69 @reply = Message.new
73 70 @reply.author = User.current
74 71 @reply.board = @board
72 @reply.safe_attributes = params[:reply]
75 73 @topic.children << @reply
76 74 if !@reply.new_record?
77 75 call_hook(:controller_messages_reply_after_save, { :params => params, :message => @reply})
78 76 attachments = Attachment.attach_files(@reply, params[:attachments])
79 77 render_attachment_warning_if_needed(@reply)
80 78 end
81 79 redirect_to :action => 'show', :id => @topic, :r => @reply
82 80 end
83 81
84 82 # Edit a message
85 83 def edit
86 84 (render_403; return false) unless @message.editable_by?(User.current)
87 if params[:message]
88 @message.locked = params[:message]['locked']
89 @message.sticky = params[:message]['sticky']
90 end
91 if request.post? && @message.update_attributes(params[:message])
85 @message.safe_attributes = params[:message]
86 if request.post? && @message.save
92 87 attachments = Attachment.attach_files(@message, params[:attachments])
93 88 render_attachment_warning_if_needed(@message)
94 89 flash[:notice] = l(:notice_successful_update)
95 90 @message.reload
96 91 redirect_to :action => 'show', :board_id => @message.board, :id => @message.root, :r => (@message.parent_id && @message.id)
97 92 end
98 93 end
99 94
100 95 # Delete a messages
101 96 def destroy
102 97 (render_403; return false) unless @message.destroyable_by?(User.current)
103 98 @message.destroy
104 99 redirect_to @message.parent.nil? ?
105 100 { :controller => 'boards', :action => 'show', :project_id => @project, :id => @board } :
106 101 { :action => 'show', :id => @message.parent, :r => @message }
107 102 end
108 103
109 104 def quote
110 105 user = @message.author
111 106 text = @message.content
112 107 subject = @message.subject.gsub('"', '\"')
113 108 subject = "RE: #{subject}" unless subject.starts_with?('RE:')
114 109 content = "#{ll(Setting.default_language, :text_user_wrote, user)}\\n> "
115 110 content << text.to_s.strip.gsub(%r{<pre>((.|\s)*?)</pre>}m, '[...]').gsub('"', '\"').gsub(/(\r?\n|\r\n?)/, "\\n> ") + "\\n\\n"
116 111 render(:update) { |page|
117 112 page << "$('message_subject').value = \"#{subject}\";"
118 113 page.<< "$('message_content').value = \"#{content}\";"
119 114 page.show 'reply'
120 115 page << "Form.Element.focus('message_content');"
121 116 page << "Element.scrollTo('reply');"
122 117 page << "$('message_content').scrollTop = $('message_content').scrollHeight - $('message_content').clientHeight;"
123 118 }
124 119 end
125 120
126 121 def preview
127 122 message = @board.messages.find_by_id(params[:id])
128 123 @attachements = message.attachments if message
129 124 @text = (params[:message] || params[:reply])[:content]
130 125 render :partial => 'common/preview'
131 126 end
132 127
133 128 private
134 129 def find_message
135 130 find_board
136 131 @message = @board.messages.find(params[:id], :include => :parent)
137 132 @topic = @message.root
138 133 rescue ActiveRecord::RecordNotFound
139 134 render_404
140 135 end
141 136
142 137 def find_board
143 138 @board = Board.find(params[:board_id], :include => :project)
144 139 @project = @board.project
145 140 rescue ActiveRecord::RecordNotFound
146 141 render_404
147 142 end
148 143 end
Show file before | Show file after | Hide comments
@@ -1,104 +1,111
1 1 # Redmine - project management software
2 2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 class Message < ActiveRecord::Base
19 include Redmine::SafeAttributes
19 20 belongs_to :board
20 21 belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
21 22 acts_as_tree :counter_cache => :replies_count, :order => "#{Message.table_name}.created_on ASC"
22 23 acts_as_attachable
23 24 belongs_to :last_reply, :class_name => 'Message', :foreign_key => 'last_reply_id'
24 25
25 26 acts_as_searchable :columns => ['subject', 'content'],
26 27 :include => {:board => :project},
27 28 :project_key => "#{Board.table_name}.project_id",
28 29 :date_column => "#{table_name}.created_on"
29 30 acts_as_event :title => Proc.new {|o| "#{o.board.name}: #{o.subject}"},
30 31 :description => :content,
31 32 :type => Proc.new {|o| o.parent_id.nil? ? 'message' : 'reply'},
32 33 :url => Proc.new {|o| {:controller => 'messages', :action => 'show', :board_id => o.board_id}.merge(o.parent_id.nil? ? {:id => o.id} :
33 34 {:id => o.parent_id, :r => o.id, :anchor => "message-#{o.id}"})}
34 35
35 36 acts_as_activity_provider :find_options => {:include => [{:board => :project}, :author]},
36 37 :author_key => :author_id
37 38 acts_as_watchable
38 39
39 40 attr_protected :locked, :sticky
40 41 validates_presence_of :board, :subject, :content
41 42 validates_length_of :subject, :maximum => 255
42 43 validate :cannot_reply_to_locked_topic, :on => :create
43 44
44 45 after_create :add_author_as_watcher, :update_parent_last_reply
45 46 after_update :update_messages_board
46 47 after_destroy :reset_board_counters
47 48
48 49 named_scope :visible, lambda {|*args| { :include => {:board => :project},
49 50 :conditions => Project.allowed_to_condition(args.shift || User.current, :view_messages, *args) } }
50 51
52 safe_attributes 'subject', 'content'
53 safe_attributes 'locked', 'sticky',
54 :if => lambda {|message, user|
55 user.allowed_to?(:edit_messages, message.project)
56 }
57
51 58 def visible?(user=User.current)
52 59 !user.nil? && user.allowed_to?(:view_messages, project)
53 60 end
54 61
55 62 def cannot_reply_to_locked_topic
56 63 # Can not reply to a locked topic
57 64 errors.add :base, 'Topic is locked' if root.locked? && self != root
58 65 end
59 66
60 67 def update_parent_last_reply
61 68 if parent
62 69 parent.reload.update_attribute(:last_reply_id, self.id)
63 70 end
64 71 board.reset_counters!
65 72 end
66 73
67 74 def update_messages_board
68 75 if board_id_changed?
69 76 Message.update_all("board_id = #{board_id}", ["id = ? OR parent_id = ?", root.id, root.id])
70 77 Board.reset_counters!(board_id_was)
71 78 Board.reset_counters!(board_id)
72 79 end
73 80 end
74 81
75 82 def reset_board_counters
76 83 board.reset_counters!
77 84 end
78 85
79 86 def sticky=(arg)
80 87 write_attribute :sticky, (arg == true || arg.to_s == '1' ? 1 : 0)
81 88 end
82 89
83 90 def sticky?
84 91 sticky == 1
85 92 end
86 93
87 94 def project
88 95 board.project
89 96 end
90 97
91 98 def editable_by?(usr)
92 99 usr && usr.logged? && (usr.allowed_to?(:edit_messages, project) || (self.author == usr && usr.allowed_to?(:edit_own_messages, project)))
93 100 end
94 101
95 102 def destroyable_by?(usr)
96 103 usr && usr.logged? && (usr.allowed_to?(:delete_messages, project) || (self.author == usr && usr.allowed_to?(:delete_own_messages, project)))
97 104 end
98 105
99 106 private
100 107
101 108 def add_author_as_watcher
102 109 Watcher.create(:watchable => self.root, :user => author)
103 110 end
104 111 end
General Comments 0
You need to be logged in to leave comments. Login now