Merge pull request #18 from finnlabs/fix/permitted_params_for_role

Fix/permitted params for role

CHANGELOG.md

@@ -1,5 +1,6 @@
 # Changelog
 
+* `#3333` [CodeClimate] Mass Assignment RolesController
 * `#2256` [Accessibility] linearisation of issue show form (2)
 * Rewritten Javascript to exclusively use jQuery
 

lib/open_project/global_roles/patches/roles_controller_patch.rb

@@ -34,7 +34,7 @@ module OpenProject::GlobalRoles::Patches
           create_global_role
         else
           #we have to duplicate unpatched behaviour here in order to set the parameters for the overwritten views
-          @role = Role.new(params[:role] || { :permissions => Role.non_member.permissions })
+          @role = Role.new(permitted_params.role? || { :permissions => Role.non_member.permissions })
           @member_permissions = (@role.setable_permissions || @permissions)
           @global_permissions = GlobalRole.setable_permissions
           create_without_global_roles
@@ -44,7 +44,7 @@ module OpenProject::GlobalRoles::Patches
       private
 
       def create_global_role
-        @role = GlobalRole.new params[:role]
+        @role = GlobalRole.new permitted_params.role
         if @role.save
           flash[:notice] = l(:notice_successful_create)
           redirect_to :action => 'index'