jro_apps/redmine Commit - r15308:cf22053dd583

Use safe_attributes for custom field enumerations....

Jean-Philippe Lang -

r15308:cf22053dd583

parent child

Context file:

r15308:cf22053dd583

Collapse all files

app/controllers/custom_field_enumerations_controller.rb +6 -2

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class CustomFieldEnumerationsController < ApplicationController
               layout 'admin'
               before_action :require_admin
               before_action :find_custom_field
               before_action :find_enumeration, :only => :destroy
               helper :custom_fields
               def index
                 @values = @custom_field.enumerations.order(:position)
               end
               def create
-                @value = @custom_field.enumerations.build(params[:custom_field_enumeration])
+                @value = @custom_field.enumerations.build
+                @value.safe_attributes = params[:custom_field_enumeration]
                 @value.save
                 respond_to do |format|
                   format.html { redirect_to custom_field_enumerations_path(@custom_field) }
                   format.js
                 end
               end
               def update_each
-                if CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations])
+                saved = CustomFieldEnumeration.update_each(@custom_field, params[:custom_field_enumerations]) do |enumeration, enumeration_attributes|
+                  enumeration.safe_attributes = enumeration_attributes
+                end
+                if saved
                   flash[:notice] = l(:notice_successful_update)
                 end
                 redirect_to :action => 'index'
               end
               def destroy
                 reassign_to = @custom_field.enumerations.find_by_id(params[:reassign_to_id])
                 if reassign_to.nil? && @value.in_use?
                   @enumerations = @custom_field.enumerations - [@value]
                   render :action => 'destroy'
                   return
                 end
                 @value.destroy(reassign_to)
                 redirect_to custom_field_enumerations_path(@custom_field)
               end
               private
               def find_custom_field
                 @custom_field = CustomField.find(params[:custom_field_id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_enumeration
                 @value = @custom_field.enumerations.find(params[:id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/models/custom_field_enumeration.rb +11 -1

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class CustomFieldEnumeration < ActiveRecord::Base
+              include Redmine::SafeAttributes
               belongs_to :custom_field
               attr_accessible :name, :active, :position
               validates_presence_of :name, :position, :custom_field_id
               validates_length_of :name, :maximum => 60
               validates_numericality_of :position, :only_integer => true
               before_create :set_position
               scope :active, lambda { where(:active => true) }
+              safe_attributes 'name',
+                'active',
+                'position'
               def to_s
                 name.to_s
               end
               def objects_count
                 custom_values.count
               end
               def in_use?
                 objects_count > 0
               end
               alias :destroy_without_reassign :destroy
               def destroy(reassign_to=nil)
                 if reassign_to
                   custom_values.update_all(:value => reassign_to.id.to_s)
                 end
                 destroy_without_reassign
               end
               def custom_values
                 custom_field.custom_values.where(:value => id.to_s)
               end
               def self.update_each(custom_field, attributes)
                 return unless attributes.is_a?(Hash)
                 transaction do
                   attributes.each do |enumeration_id, enumeration_attributes|
                     enumeration = custom_field.enumerations.find_by_id(enumeration_id)
                     if enumeration
-                      enumeration.attributes = enumeration_attributes
+                      if block_given?
+                        yield enumeration, enumeration_attributes
+                      else
+                        enumeration.attributes = enumeration_attributes
+                      end
                       unless enumeration.save
                         raise ActiveRecord::Rollback
                       end
                     end
                   end
                 end
               end
               def self.fields_for_order_statement(table=nil)
                 table ||= table_name
                 columns = ['position']
                 columns.uniq.map {|field| "#{table}.#{field}"}
               end
               private
               def set_position
                 max = self.class.where(:custom_field_id => custom_field_id).maximum(:position) || 0
                 self.position = max + 1
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages