##// END OF EJS Templates
Prevent mass-assignment when adding/updating a document (#10390)....
Jean-Philippe Lang -
r9010:809d35d34bc4
parent child
Show More
@@ -1,89 +1,92
1 1 # Redmine - project management software
2 2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 class DocumentsController < ApplicationController
19 19 default_search_scope :documents
20 20 model_object Document
21 21 before_filter :find_project_by_project_id, :only => [:index, :new, :create]
22 22 before_filter :find_model_object, :except => [:index, :new, :create]
23 23 before_filter :find_project_from_association, :except => [:index, :new, :create]
24 24 before_filter :authorize
25 25
26 26 helper :attachments
27 27
28 28 def index
29 29 @sort_by = %w(category date title author).include?(params[:sort_by]) ? params[:sort_by] : 'category'
30 30 documents = @project.documents.find :all, :include => [:attachments, :category]
31 31 case @sort_by
32 32 when 'date'
33 33 @grouped = documents.group_by {|d| d.updated_on.to_date }
34 34 when 'title'
35 35 @grouped = documents.group_by {|d| d.title.first.upcase}
36 36 when 'author'
37 37 @grouped = documents.select{|d| d.attachments.any?}.group_by {|d| d.attachments.last.author}
38 38 else
39 39 @grouped = documents.group_by(&:category)
40 40 end
41 41 @document = @project.documents.build
42 42 render :layout => false if request.xhr?
43 43 end
44 44
45 45 def show
46 46 @attachments = @document.attachments.find(:all, :order => "created_on DESC")
47 47 end
48 48
49 49 def new
50 @document = @project.documents.build(params[:document])
50 @document = @project.documents.build
51 @document.safe_attributes = params[:document]
51 52 end
52 53
53 54 def create
54 @document = @project.documents.build(params[:document])
55 @document = @project.documents.build
56 @document.safe_attributes = params[:document]
55 57 @document.save_attachments(params[:attachments])
56 58 if @document.save
57 59 render_attachment_warning_if_needed(@document)
58 60 flash[:notice] = l(:notice_successful_create)
59 61 redirect_to :action => 'index', :project_id => @project
60 62 else
61 63 render :action => 'new'
62 64 end
63 65 end
64 66
65 67 def edit
66 68 end
67 69
68 70 def update
69 if request.put? and @document.update_attributes(params[:document])
71 @document.safe_attributes = params[:document]
72 if request.put? and @document.save
70 73 flash[:notice] = l(:notice_successful_update)
71 74 redirect_to :action => 'show', :id => @document
72 75 else
73 76 render :action => 'edit'
74 77 end
75 78 end
76 79
77 80 def destroy
78 81 @document.destroy if request.delete?
79 82 redirect_to :controller => 'documents', :action => 'index', :project_id => @project
80 83 end
81 84
82 85 def add_attachment
83 86 attachments = Attachment.attach_files(@document, params[:attachments])
84 87 render_attachment_warning_if_needed(@document)
85 88
86 89 Mailer.deliver_attachments_added(attachments[:files]) if attachments.present? && attachments[:files].present? && Setting.notified_events.include?('document_added')
87 90 redirect_to :action => 'show', :id => @document
88 91 end
89 92 end
@@ -1,53 +1,56
1 1 # RedMine - project management software
2 2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 class Document < ActiveRecord::Base
19 include Redmine::SafeAttributes
19 20 belongs_to :project
20 21 belongs_to :category, :class_name => "DocumentCategory", :foreign_key => "category_id"
21 22 acts_as_attachable :delete_permission => :manage_documents
22 23
23 24 acts_as_searchable :columns => ['title', "#{table_name}.description"], :include => :project
24 25 acts_as_event :title => Proc.new {|o| "#{l(:label_document)}: #{o.title}"},
25 26 :author => Proc.new {|o| (a = o.attachments.find(:first, :order => "#{Attachment.table_name}.created_on ASC")) ? a.author : nil },
26 27 :url => Proc.new {|o| {:controller => 'documents', :action => 'show', :id => o.id}}
27 28 acts_as_activity_provider :find_options => {:include => :project}
28 29
29 30 validates_presence_of :project, :title, :category
30 31 validates_length_of :title, :maximum => 60
31 32
32 33 named_scope :visible, lambda {|*args| { :include => :project,
33 34 :conditions => Project.allowed_to_condition(args.shift || User.current, :view_documents, *args) } }
34 35
36 safe_attributes 'category_id', 'title', 'description'
37
35 38 def visible?(user=User.current)
36 39 !user.nil? && user.allowed_to?(:view_documents, project)
37 40 end
38 41
39 42 def initialize(attributes=nil, *args)
40 43 super
41 44 if new_record?
42 45 self.category ||= DocumentCategory.default
43 46 end
44 47 end
45 48
46 49 def updated_on
47 50 unless @updated_on
48 51 a = attachments.last
49 52 @updated_on = (a && a.created_on) || created_on
50 53 end
51 54 @updated_on
52 55 end
53 56 end
General Comments 0
You need to be logged in to leave comments. Login now