jro_apps/redmine Commit - r15287:dca56a0350c3

Use safe_attributes....

Jean-Philippe Lang -

r15287:dca56a0350c3

parent child

Context file:

r15287:dca56a0350c3

Collapse all files

app/controllers/trackers_controller.rb +6 -3

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TrackersController < ApplicationController
               layout 'admin'
               before_action :require_admin, :except => :index
               before_action :require_admin_or_api_request, :only => :index
               accept_api_auth :index
               def index
                 @trackers = Tracker.sorted.to_a
                 respond_to do |format|
                   format.html { render :layout => false if request.xhr? }
                   format.api
                 end
               end
               def new
-                @tracker ||= Tracker.new(params[:tracker])
+                @tracker ||= Tracker.new
+                @tracker.safe_attributes = params[:tracker]
                 @trackers = Tracker.sorted.to_a
                 @projects = Project.all
               end
               def create
-                @tracker = Tracker.new(params[:tracker])
+                @tracker = Tracker.new
+                @tracker.safe_attributes = params[:tracker]
                 if @tracker.save
                   # workflow copy
                   if !params[:copy_workflow_from].blank? && (copy_from = Tracker.find_by_id(params[:copy_workflow_from]))
                     @tracker.workflow_rules.copy(copy_from)
                   end
                   flash[:notice] = l(:notice_successful_create)
                   redirect_to trackers_path
                   return
                 end
                 new
                 render :action => 'new'
               end
               def edit
                 @tracker ||= Tracker.find(params[:id])
                 @projects = Project.all
               end
               def update
                 @tracker = Tracker.find(params[:id])
-                if @tracker.update_attributes(params[:tracker])
+                @tracker.safe_attributes = params[:tracker]
+                if @tracker.save
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_update)
                       redirect_to trackers_path(:page => params[:page])
                     }
                     format.js { render :nothing => true }
                   end
                 else
                   respond_to do |format|
                     format.html {
                       edit
                       render :action => 'edit'
                     }
                     format.js { render :nothing => true, :status => 422 }
                   end
                 end
               end
               def destroy
                 @tracker = Tracker.find(params[:id])
                 unless @tracker.issues.empty?
                   flash[:error] = l(:error_can_not_delete_tracker)
                 else
                   @tracker.destroy
                 end
                 redirect_to trackers_path
               end
               def fields
                 if request.post? && params[:trackers]
                   params[:trackers].each do |tracker_id, tracker_params|
                     tracker = Tracker.find_by_id(tracker_id)
                     if tracker
                       tracker.core_fields = tracker_params[:core_fields]
                       tracker.custom_field_ids = tracker_params[:custom_field_ids]
                       tracker.save
                     end
                   end
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to fields_trackers_path
                   return
                 end
                 @trackers = Tracker.sorted.to_a
                 @custom_fields = IssueCustomField.all.sort
               end
             end

app/models/tracker.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Tracker < ActiveRecord::Base
+              include Redmine::SafeAttributes
               CORE_FIELDS_UNDISABLABLE = %w(project_id tracker_id subject description priority_id is_private).freeze
               # Fields that can be disabled
               # Other (future) fields should be appended, not inserted!
               CORE_FIELDS = %w(assigned_to_id category_id fixed_version_id parent_issue_id start_date due_date estimated_hours done_ratio).freeze
               CORE_FIELDS_ALL = (CORE_FIELDS_UNDISABLABLE + CORE_FIELDS).freeze
               before_destroy :check_integrity
               belongs_to :default_status, :class_name => 'IssueStatus'
               has_many :issues
               has_many :workflow_rules, :dependent => :delete_all do
                 def copy(source_tracker)
                   WorkflowRule.copy(source_tracker, nil, proxy_association.owner, nil)
                 end
               end
               has_and_belongs_to_many :projects
               has_and_belongs_to_many :custom_fields, :class_name => 'IssueCustomField', :join_table => "#{table_name_prefix}custom_fields_trackers#{table_name_suffix}", :association_foreign_key => 'custom_field_id'
               acts_as_positioned
               attr_protected :fields_bits
               validates_presence_of :default_status
               validates_presence_of :name
               validates_uniqueness_of :name
               validates_length_of :name, :maximum => 30
               scope :sorted, lambda { order(:position) }
               scope :named, lambda {|arg| where("LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip)}
               # Returns the trackers that are visible by the user.
               #
               # Examples:
               #   project.trackers.visible(user)
               #   => returns the trackers that are visible by the user in project
               #
               #   Tracker.visible(user)
               #   => returns the trackers that are visible by the user in at least on project
               scope :visible, lambda {|*args|
                 user = args.shift || User.current
                 condition = Project.allowed_to_condition(user, :view_issues) do |role, user|
                   unless role.permissions_all_trackers?(:view_issues)
                     tracker_ids = role.permissions_tracker_ids(:view_issues)
                     if tracker_ids.any?
                       "#{Tracker.table_name}.id IN (#{tracker_ids.join(',')})"
                     else
                       '1=0'
                     end
                   end
                 end
                 joins(:projects).where(condition).distinct
               }
+              safe_attributes 'name',
+                'default_status_id',
+                'is_in_roadmap',
+                'core_fields',
+                'position',
+                'custom_field_ids',
+                'project_ids'
               def to_s; name end
               def <=>(tracker)
                 position <=> tracker.position
               end
               # Returns an array of IssueStatus that are used
               # in the tracker's workflows
               def issue_statuses
                 @issue_statuses ||= IssueStatus.where(:id => issue_status_ids).to_a.sort
               end
               def issue_status_ids
                 if new_record?
                   []
                 else
                   @issue_status_ids ||= WorkflowTransition.where(:tracker_id => id).distinct.pluck(:old_status_id, :new_status_id).flatten.uniq
                 end
               end
               def disabled_core_fields
                 i = -1
                 @disabled_core_fields ||= CORE_FIELDS.select { i += 1; (fields_bits || 0) & (2 ** i) != 0}
               end
               def core_fields
                 CORE_FIELDS - disabled_core_fields
               end
               def core_fields=(fields)
                 raise ArgumentError.new("Tracker.core_fields takes an array") unless fields.is_a?(Array)
                 bits = 0
                 CORE_FIELDS.each_with_index do |field, i|
                   unless fields.include?(field)
                     bits |= 2 ** i
                   end
                 end
                 self.fields_bits = bits
                 @disabled_core_fields = nil
                 core_fields
               end
               # Returns the fields that are disabled for all the given trackers
               def self.disabled_core_fields(trackers)
                 if trackers.present?
                   trackers.map(&:disabled_core_fields).reduce(:&)
                 else
                   []
                 end
               end
               # Returns the fields that are enabled for one tracker at least
               def self.core_fields(trackers)
                 if trackers.present?
                   trackers.uniq.map(&:core_fields).reduce(:|)
                 else
                   CORE_FIELDS.dup
                 end
               end
             private
               def check_integrity
                 raise Exception.new("Cannot delete tracker") if Issue.where(:tracker_id => self.id).any?
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages