##// END OF EJS Templates
jro_apps » redmine
RSS
Use safe_attributes for auth sources....
Jean-Philippe Lang -
r15310:d7a6c09822bc
parent child
Show More
Side by Side Unified
Context file:
r15310:d7a6c09822bc Loading diff...:
Show file before | Show file after | Hide comments
@@ -20,6 +20,7 class AuthSourcesController < ApplicationController
20 menu_item :ldap_authentication
20 menu_item :ldap_authentication
21
21
22 before_action :require_admin
22 before_action :require_admin
23 before_action :build_new_auth_source, :only => [:new, :create]
23 before_action :find_auth_source, :only => [:edit, :update, :test_connection, :destroy]
24 before_action :find_auth_source, :only => [:edit, :update, :test_connection, :destroy]
24 require_sudo_mode :update, :destroy
25 require_sudo_mode :update, :destroy
25
26
@@ -28,13 +29,9 class AuthSourcesController < ApplicationController
28 end
29 end
29
30
30 def new
31 def new
31 klass_name = params[:type] || 'AuthSourceLdap'
32 @auth_source = AuthSource.new_subclass_instance(klass_name, params[:auth_source])
33 render_404 unless @auth_source
34 end
32 end
35
33
36 def create
34 def create
37 @auth_source = AuthSource.new_subclass_instance(params[:type], params[:auth_source])
38 if @auth_source.save
35 if @auth_source.save
39 flash[:notice] = l(:notice_successful_create)
36 flash[:notice] = l(:notice_successful_create)
40 redirect_to auth_sources_path
37 redirect_to auth_sources_path
@@ -47,7 +44,8 class AuthSourcesController < ApplicationController
47 end
44 end
48
45
49 def update
46 def update
50 if @auth_source.update_attributes(params[:auth_source])
47 @auth_source.safe_attributes = params[:auth_source]
48 if @auth_source.save
51 flash[:notice] = l(:notice_successful_update)
49 flash[:notice] = l(:notice_successful_update)
52 redirect_to auth_sources_path
50 redirect_to auth_sources_path
53 else
51 else
@@ -89,6 +87,15 class AuthSourcesController < ApplicationController
89
87
90 private
88 private
91
89
90 def build_new_auth_source
91 @auth_source = AuthSource.new_subclass_instance(params[:type] || 'AuthSourceLdap')
92 if @auth_source
93 @auth_source.safe_attributes = params[:auth_source]
94 else
95 render_404
96 end
97 end
98
92 def find_auth_source
99 def find_auth_source
93 @auth_source = AuthSource.find(params[:id])
100 @auth_source = AuthSource.find(params[:id])
94 rescue ActiveRecord::RecordNotFound
101 rescue ActiveRecord::RecordNotFound
Show file before | Show file after | Hide comments
@@ -21,6 +21,7 class AuthSourceException < Exception; end
21 class AuthSourceTimeoutException < AuthSourceException; end
21 class AuthSourceTimeoutException < AuthSourceException; end
22
22
23 class AuthSource < ActiveRecord::Base
23 class AuthSource < ActiveRecord::Base
24 include Redmine::SafeAttributes
24 include Redmine::SubclassFactory
25 include Redmine::SubclassFactory
25 include Redmine::Ciphering
26 include Redmine::Ciphering
26
27
@@ -31,6 +32,21 class AuthSource < ActiveRecord::Base
31 validates_length_of :name, :maximum => 60
32 validates_length_of :name, :maximum => 60
32 attr_protected :id
33 attr_protected :id
33
34
35 safe_attributes 'name',
36 'host',
37 'port',
38 'account',
39 'account_password',
40 'base_dn',
41 'attr_login',
42 'attr_firstname',
43 'attr_lastname',
44 'attr_mail',
45 'onthefly_register',
46 'tls',
47 'filter',
48 'timeout'
49
34 def authenticate(login, password)
50 def authenticate(login, password)
35 end
51 end
36
52
General Comments 0
You need to be logged in to leave comments. Login now