| @@ -453,12 +453,14 class Issue < ActiveRecord::Base | |||||
| 453 |
|
453 | |||
| 454 | if attrs['custom_field_values'].present? |
|
454 | if attrs['custom_field_values'].present? | |
| 455 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} |
|
455 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} | |
| 456 | attrs['custom_field_values'] = attrs['custom_field_values'].select {|k, v| editable_custom_field_ids.include? k.to_s} |
|
456 | # TODO: use #select when ruby1.8 support is dropped | |
|
|
457 | attrs['custom_field_values'] = attrs['custom_field_values'].reject {|k, v| !editable_custom_field_ids.include?(k.to_s)} | |||
| 457 | end |
|
458 | end | |
| 458 |
|
459 | |||
| 459 | if attrs['custom_fields'].present? |
|
460 | if attrs['custom_fields'].present? | |
| 460 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} |
|
461 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} | |
| 461 | attrs['custom_fields'] = attrs['custom_fields'].select {|c| editable_custom_field_ids.include? c['id'].to_s} |
|
462 | # TODO: use #select when ruby1.8 support is dropped | |
|
|
463 | attrs['custom_fields'] = attrs['custom_fields'].reject {|c| !editable_custom_field_ids.include?(c['id'].to_s)} | |||
| 462 | end |
|
464 | end | |
| 463 |
|
465 | |||
| 464 | # mass-assignment security bypass |
|
466 | # mass-assignment security bypass | |
General Comments 0
You need to be logged in to leave comments.
Login now