Avoiding update_attributes and new for Issues

Using safe_attributes= from core instead to avoid mass assignment vulnerability
pull/6827/head
Gregor Schmidt 13 years ago
parent b5c6b69d2d
commit 61936a8475
  1. 3
      app/controllers/rb_stories_controller.rb
  2. 14
      app/models/story.rb
  3. 2
      features/step_definitions/_given_steps.rb

@ -14,7 +14,8 @@ class RbStoriesController < RbApplicationController
def create
params['author_id'] = User.current.id
story = Story.create_and_position(params)
story = Story.create_and_position(params, :project => @project,
:author => User.current)
status = (story.id ? 200 : 400)
respond_to do |format|

@ -40,11 +40,12 @@ class Story < Issue
Story.backlog(project.id, sprint.id, options)
end
def self.create_and_position(params)
attribs = params.select{|k,v| k != 'prev_id' and k != 'id' and Story.column_names.include? k }
attribs = Hash[*attribs.flatten]
def self.create_and_position(params, safer_attributes)
Story.new.tap do |s|
s.safe_attributes = params
s.author = safer_attributes[:author] if safer_attributes[:author]
s.project = safer_attributes[:project] if safer_attributes[:project]
Story.new(attribs).tap do |s|
if s.save
s.move_after(params['prev_id'])
end
@ -122,10 +123,9 @@ class Story < Issue
end
def update_and_position!(params)
attribs = params.select { |k,v| k != 'id' and Story.column_names.include?(k) }
attribs = Hash[*attribs.flatten]
self.safe_attributes = params
journalized_update_attributes(attribs).tap do |result|
save.tap do |result|
if result and params[:prev]
reload
move_after(params[:prev])

@ -158,7 +158,7 @@ Given /^the [pP]roject(?: "([^\"]*)")? has the following stories in the followin
# NOTE: We're bypassing the controller here because we're just
# setting up the database for the actual tests. The actual tests,
# however, should NOT bypass the controller
s = Story.create_and_position params
s = Story.create_and_position params, :project => project
prev_id = s.id
end
end

Loading…
Cancel
Save