jro_apps/redmine Commit - r9026:5141f1e4741d

Merged r9129 from trunk....

Jean-Philippe Lang -

r9026:5141f1e4741d

parent child

Context file:

r9026:5141f1e4741d

Collapse all files

app/controllers/comments_controller.rb +2 -1

             class CommentsController < ApplicationController
               default_search_scope :news
               model_object News
               before_filter :find_model_object
               before_filter :find_project_from_association
               before_filter :authorize
               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
-                @comment = Comment.new(params[:comment])
+                @comment = Comment.new
+                @comment.safe_attributes = params[:comment]
                 @comment.author = User.current
                 if @news.comments << @comment
                   flash[:notice] = l(:label_comment_added)
                 end
                 redirect_to :controller => 'news', :action => 'show', :id => @news
               end
               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @news.comments.find(params[:comment_id]).destroy
                 redirect_to :controller => 'news', :action => 'show', :id => @news
               end
               private
               # ApplicationController's find_model_object sets it based on the controller
               # name so it needs to be overriden and set to @news instead
               def find_model_object
                 super
                 @news = @object
                 @comment = nil
                 @news
               end
             end

app/models/comment.rb +3 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Comment < ActiveRecord::Base
+              include Redmine::SafeAttributes
               belongs_to :commented, :polymorphic => true, :counter_cache => true
               belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
               validates_presence_of :commented, :author, :comments
+              safe_attributes 'comments'
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages