jro_apps/redmine Commit - r9563:9f531a438085

Use safe_attributes in GroupsController....

Jean-Philippe Lang -

r9563:9f531a438085

parent child

Context file:

r9563:9f531a438085

Collapse all files

app/controllers/groups_controller.rb +4 -2

             # Redmine - project management software
             # Copyright (C) 2006-2012  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class GroupsController < ApplicationController
               layout 'admin'
               before_filter :require_admin
               helper :custom_fields
               # GET /groups
               # GET /groups.xml
               def index
                 @groups = Group.find(:all, :order => 'lastname')
                 respond_to do |format|
                   format.html # index.html.erb
                   format.xml  { render :xml => @groups }
                 end
               end
               # GET /groups/1
               # GET /groups/1.xml
               def show
                 @group = Group.find(params[:id])
                 respond_to do |format|
                   format.html # show.html.erb
                   format.xml  { render :xml => @group }
                 end
               end
               # GET /groups/new
               # GET /groups/new.xml
               def new
                 @group = Group.new
                 respond_to do |format|
                   format.html # new.html.erb
                   format.xml  { render :xml => @group }
                 end
               end
               # GET /groups/1/edit
               def edit
                 @group = Group.find(params[:id], :include => :projects)
               end
               # POST /groups
               # POST /groups.xml
               def create
-                @group = Group.new(params[:group])
+                @group = Group.new
+                @group.safe_attributes = params[:group]
                 respond_to do |format|
                   if @group.save
                     format.html {
                       flash[:notice] = l(:notice_successful_create)
                       redirect_to(params[:continue] ? new_group_path : groups_path)
                     }
                     format.xml  { render :xml => @group, :status => :created, :location => @group }
                   else
                     format.html { render :action => "new" }
                     format.xml  { render :xml => @group.errors, :status => :unprocessable_entity }
                   end
                 end
               end
               # PUT /groups/1
               # PUT /groups/1.xml
               def update
                 @group = Group.find(params[:id])
+                @group.safe_attributes = params[:group]
                 respond_to do |format|
-                  if @group.update_attributes(params[:group])
+                  if @group.save
                     flash[:notice] = l(:notice_successful_update)
                     format.html { redirect_to(groups_path) }
                     format.xml  { head :ok }
                   else
                     format.html { render :action => "edit" }
                     format.xml  { render :xml => @group.errors, :status => :unprocessable_entity }
                   end
                 end
               end
               # DELETE /groups/1
               # DELETE /groups/1.xml
               def destroy
                 @group = Group.find(params[:id])
                 @group.destroy
                 respond_to do |format|
                   format.html { redirect_to(groups_url) }
                   format.xml  { head :ok }
                 end
               end
               def add_users
                 @group = Group.find(params[:id])
                 users = User.find_all_by_id(params[:user_ids])
                 @group.users << users if request.post?
                 respond_to do |format|
                   format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'users' }
                   format.js {
                     render(:update) {|page|
                       page.replace_html "tab-content-users", :partial => 'groups/users'
                       users.each {|user| page.visual_effect(:highlight, "user-#{user.id}") }
                     }
                   }
                 end
               end
               def remove_user
                 @group = Group.find(params[:id])
                 @group.users.delete(User.find(params[:user_id])) if request.delete?
                 respond_to do |format|
                   format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'users' }
                   format.js { render(:update) {|page| page.replace_html "tab-content-users", :partial => 'groups/users'} }
                 end
               end
               def autocomplete_for_user
                 @group = Group.find(params[:id])
                 @users = User.active.not_in_group(@group).like(params[:q]).all(:limit => 100)
                 render :layout => false
               end
               def edit_membership
                 @group = Group.find(params[:id])
                 @membership = Member.edit_membership(params[:membership_id], params[:membership], @group)
                 @membership.save if request.post?
                 respond_to do |format|
                   if @membership.valid?
                     format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'memberships' }
                     format.js {
                       render(:update) {|page|
                         page.replace_html "tab-content-memberships", :partial => 'groups/memberships'
                         page.visual_effect(:highlight, "member-#{@membership.id}")
                       }
                     }
                   else
                     format.js {
                       render(:update) {|page|
                         page.alert(l(:notice_failed_to_save_members, :errors => @membership.errors.full_messages.join(', ')))
                       }
                     }
                   end
                 end
               end
               def destroy_membership
                 @group = Group.find(params[:id])
                 Member.find(params[:membership_id]).destroy if request.post?
                 respond_to do |format|
                   format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'memberships' }
                   format.js { render(:update) {|page| page.replace_html "tab-content-memberships", :partial => 'groups/memberships'} }
                 end
               end
             end

app/models/group.rb +7 0

             # Redmine - project management software
             # Copyright (C) 2006-2012  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Group < Principal
+              include Redmine::SafeAttributes
               has_and_belongs_to_many :users, :after_add => :user_added,
                                               :after_remove => :user_removed
               acts_as_customizable
               validates_presence_of :lastname
               validates_uniqueness_of :lastname, :case_sensitive => false
               validates_length_of :lastname, :maximum => 30
               before_destroy :remove_references_before_destroy
+              safe_attributes 'name',
+                'custom_field_values',
+                'custom_fields',
+                :if => lambda {|group, user| user.admin?}
               def to_s
                 lastname.to_s
               end
               def name
                 lastname
               end
               def name=(arg)
                 self.lastname = arg
               end
               def user_added(user)
                 members.each do |member|
                   next if member.project.nil?
                   user_member = Member.find_by_project_id_and_user_id(member.project_id, user.id) || Member.new(:project_id => member.project_id, :user_id => user.id)
                   member.member_roles.each do |member_role|
                     user_member.member_roles << MemberRole.new(:role => member_role.role, :inherited_from => member_role.id)
                   end
                   user_member.save!
                 end
               end
               def user_removed(user)
                 members.each do |member|
                   MemberRole.find(:all, :include => :member,
                                         :conditions => ["#{Member.table_name}.user_id = ? AND #{MemberRole.table_name}.inherited_from IN (?)", user.id, member.member_role_ids]).each(&:destroy)
                 end
               end
               def self.human_attribute_name(attribute_key_name, *args)
                 attr_name = attribute_key_name.to_s
                 if attr_name == 'lastname'
                   attr_name = "name"
                 end
                 super(attr_name, *args)
               end
               private
               # Removes references that are not handled by associations
               def remove_references_before_destroy
                 return if self.id.nil?
                 Issue.update_all 'assigned_to_id = NULL', ['assigned_to_id = ?', id]
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages