| @@ -453,12 +453,14 class Issue < ActiveRecord::Base | |||
|
|
453 | 453 | |
|
|
454 | 454 | if attrs['custom_field_values'].present? |
|
|
455 | 455 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} |
|
|
456 | attrs['custom_field_values'] = attrs['custom_field_values'].select {|k, v| editable_custom_field_ids.include? k.to_s} | |
|
|
456 | # TODO: use #select when ruby1.8 support is dropped | |
|
|
457 | attrs['custom_field_values'] = attrs['custom_field_values'].reject {|k, v| !editable_custom_field_ids.include?(k.to_s)} | |
|
|
457 | 458 | end |
|
|
458 | 459 | |
|
|
459 | 460 | if attrs['custom_fields'].present? |
|
|
460 | 461 | editable_custom_field_ids = editable_custom_field_values(user).map {|v| v.custom_field_id.to_s} |
|
|
461 | attrs['custom_fields'] = attrs['custom_fields'].select {|c| editable_custom_field_ids.include? c['id'].to_s} | |
|
|
462 | # TODO: use #select when ruby1.8 support is dropped | |
|
|
463 | attrs['custom_fields'] = attrs['custom_fields'].reject {|c| !editable_custom_field_ids.include?(c['id'].to_s)} | |
|
|
462 | 464 | end |
|
|
463 | 465 | |
|
|
464 | 466 | # mass-assignment security bypass |
General Comments 0
You need to be logged in to leave comments.
Login now