jro_apps/redmine Commit - r9010:809d35d34bc4

Prevent mass-assignment when adding/updating a document (#10390)....

Jean-Philippe Lang -

r9010:809d35d34bc4

parent child

Context file:

r9010:809d35d34bc4

Collapse all files

app/controllers/documents_controller.rb +6 -3

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class DocumentsController < ApplicationController
               default_search_scope :documents
               model_object Document
               before_filter :find_project_by_project_id, :only => [:index, :new, :create]
               before_filter :find_model_object, :except => [:index, :new, :create]
               before_filter :find_project_from_association, :except => [:index, :new, :create]
               before_filter :authorize
               helper :attachments
               def index
                 @sort_by = %w(category date title author).include?(params[:sort_by]) ? params[:sort_by] : 'category'
                 documents = @project.documents.find :all, :include => [:attachments, :category]
                 case @sort_by
                 when 'date'
                   @grouped = documents.group_by {|d| d.updated_on.to_date }
                 when 'title'
                   @grouped = documents.group_by {|d| d.title.first.upcase}
                 when 'author'
                   @grouped = documents.select{|d| d.attachments.any?}.group_by {|d| d.attachments.last.author}
                 else
                   @grouped = documents.group_by(&:category)
                 end
                 @document = @project.documents.build
                 render :layout => false if request.xhr?
               end
               def show
                 @attachments = @document.attachments.find(:all, :order => "created_on DESC")
               end
               def new
-                @document = @project.documents.build(params[:document])
+                @document = @project.documents.build
+                @document.safe_attributes = params[:document]
               end
               def create
-                @document = @project.documents.build(params[:document])
+                @document = @project.documents.build
+                @document.safe_attributes = params[:document]
                 @document.save_attachments(params[:attachments])
                 if @document.save
                   render_attachment_warning_if_needed(@document)
                   flash[:notice] = l(:notice_successful_create)
                   redirect_to :action => 'index', :project_id => @project
                 else
                   render :action => 'new'
                 end
               end
               def edit
               end
               def update
-                if request.put? and @document.update_attributes(params[:document])
+                @document.safe_attributes = params[:document]
+                if request.put? and @document.save
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :action => 'show', :id => @document
                 else
                   render :action => 'edit'
                 end
               end
               def destroy
                 @document.destroy if request.delete?
                 redirect_to :controller => 'documents', :action => 'index', :project_id => @project
               end
               def add_attachment
                 attachments = Attachment.attach_files(@document, params[:attachments])
                 render_attachment_warning_if_needed(@document)
                 Mailer.deliver_attachments_added(attachments[:files]) if attachments.present? && attachments[:files].present? && Setting.notified_events.include?('document_added')
                 redirect_to :action => 'show', :id => @document
               end
             end

app/models/document.rb +3 0

             # RedMine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Document < ActiveRecord::Base
+              include Redmine::SafeAttributes
               belongs_to :project
               belongs_to :category, :class_name => "DocumentCategory", :foreign_key => "category_id"
               acts_as_attachable :delete_permission => :manage_documents
               acts_as_searchable :columns => ['title', "#{table_name}.description"], :include => :project
               acts_as_event :title => Proc.new {|o| "#{l(:label_document)}: #{o.title}"},
                             :author => Proc.new {|o| (a = o.attachments.find(:first, :order => "#{Attachment.table_name}.created_on ASC")) ? a.author : nil },
                             :url => Proc.new {|o| {:controller => 'documents', :action => 'show', :id => o.id}}
               acts_as_activity_provider :find_options => {:include => :project}
               validates_presence_of :project, :title, :category
               validates_length_of :title, :maximum => 60
               named_scope :visible, lambda {|*args| { :include => :project,
                                                       :conditions => Project.allowed_to_condition(args.shift || User.current, :view_documents, *args) } }
+              safe_attributes 'category_id', 'title', 'description'
               def visible?(user=User.current)
                 !user.nil? && user.allowed_to?(:view_documents, project)
               end
               def initialize(attributes=nil, *args)
                 super
                 if new_record?
                   self.category ||= DocumentCategory.default
                 end
               end
               def updated_on
                 unless @updated_on
                   a = attachments.last
                   @updated_on = (a && a.created_on) || created_on
                 end
                 @updated_on
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages