nested tab attributes are safe, one cannot fake project_id, nor wiki_id

13 years ago · 284f689bd7
parent fa26c9ceee
commit 284f689bd7
1 changed files with 1 additions and 1 deletions
--- a/app/models/wiki.rb
+++ b/app/models/wiki.rb
@ -25,7 +25,7 @@ class Wiki < ActiveRecord::Base
  validates_presence_of :start_page
  validates_format_of :start_page, :with => /^[^,\.\/\?\;\|\:]*$/

-  safe_attributes 'start_page'
+  safe_attributes 'start_page', 'tabs_attributes'

  def visible?(user=User.current)
    !user.nil? && user.allowed_to?(:view_wiki_pages, project)