Avoiding update_attributes and new for Issues

Using safe_attributes= from core instead to avoid mass assignment vulnerability

app/controllers/rb_stories_controller.rb

@@ -14,7 +14,8 @@ class RbStoriesController < RbApplicationController
 
   def create
     params['author_id'] = User.current.id
-    story = Story.create_and_position(params)
+    story = Story.create_and_position(params, :project => @project,
+                                              :author => User.current)
     status = (story.id ? 200 : 400)
 
     respond_to do |format|

app/models/story.rb

@@ -40,11 +40,12 @@ class Story < Issue
     Story.backlog(project.id, sprint.id, options)
   end
 
-  def self.create_and_position(params)
+  def self.create_and_position(params, safer_attributes)
-    attribs = params.select{|k,v| k != 'prev_id' and k != 'id' and Story.column_names.include? k }
+    Story.new.tap do |s|
-    attribs = Hash[*attribs.flatten]
+      s.safe_attributes = params
+      s.author  = safer_attributes[:author]  if safer_attributes[:author]
+      s.project = safer_attributes[:project] if safer_attributes[:project]
 
-    Story.new(attribs).tap do |s|
       if s.save
         s.move_after(params['prev_id'])
       end
@@ -122,10 +123,9 @@ class Story < Issue
   end
 
   def update_and_position!(params)
-    attribs = params.select { |k,v| k != 'id' and Story.column_names.include?(k) }
+    self.safe_attributes = params
-    attribs = Hash[*attribs.flatten]
 
-    journalized_update_attributes(attribs).tap do |result|
+    save.tap do |result|
       if result and params[:prev]
         reload
         move_after(params[:prev])

features/step_definitions/_given_steps.rb

@@ -158,7 +158,7 @@ Given /^the [pP]roject(?: "([^\"]*)")? has the following stories in the followin
     # NOTE: We're bypassing the controller here because we're just
     # setting up the database for the actual tests. The actual tests,
     # however, should NOT bypass the controller
-    s = Story.create_and_position params
+    s = Story.create_and_position params, :project => project
     prev_id = s.id
   end
 end