##// END OF EJS Templates
Prevent mass-assignment when adding a project member (#10390)....
Jean-Philippe Lang -
r9012:2c6ad7525aa7
parent child
Show More
@@ -49,16 +49,18 class MembersController < ApplicationController
49 49
50 50 def create
51 51 members = []
52 if params[:membership] && params[:membership][:user_ids]
52 if params[:membership]
53 if params[:membership][:user_ids]
53 54 attrs = params[:membership].dup
54 55 user_ids = attrs.delete(:user_ids)
55 56 user_ids.each do |user_id|
56 members << Member.new(attrs.merge(:user_id => user_id))
57 members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => user_id)
57 58 end
58 59 else
59 members << Member.new(params[:membership])
60 members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => params[:membership][:user_id])
60 61 end
61 62 @project.members << members
63 end
62 64
63 65 respond_to do |format|
64 66 if members.present? && members.all? {|m| m.valid? }
General Comments 0
You need to be logged in to leave comments. Login now