diff --git a/app/models/permitted_params.rb b/app/models/permitted_params.rb index 6e7230653e..c8b6709b39 100644 --- a/app/models/permitted_params.rb +++ b/app/models/permitted_params.rb @@ -325,16 +325,19 @@ class PermittedParams # `version_settings_attributes` is from a plugin. Unfortunately as it stands # now it is less work to do it this way than have the plugin override this # method. We hopefully will change this in the future. - params.fetch(:version, {}).permit(:name, - :description, - :effective_date, - :due_date, - :start_date, - :wiki_page_title, - :status, - :sharing, - :custom_field_value, - version_settings_attributes: [:id, :display, :project_id]) + permitted_params = params.fetch(:version, {}).permit(:name, + :description, + :effective_date, + :due_date, + :start_date, + :wiki_page_title, + :status, + :sharing, + version_settings_attributes: [:id, + :display, + :project_id]) + + permitted_params.merge(custom_field_values(:version, required: false)) end def comment diff --git a/spec/models/permitted_params_spec.rb b/spec/models/permitted_params_spec.rb index f5cbc717b1..3df5ff9661 100644 --- a/spec/models/permitted_params_spec.rb +++ b/spec/models/permitted_params_spec.rb @@ -251,8 +251,7 @@ describe PermittedParams, type: :model do describe '#version' do it 'should permit its whitelisted params' do acceptable_params = [:name, :description, :effective_date, :due_date, - :start_date, :wiki_page_title, :status, :sharing, - :custom_field_value] + :start_date, :wiki_page_title, :status, :sharing] acceptable_params_with_data = HashWithIndifferentAccess[acceptable_params.map {|x| [x, 'value']}] @@ -269,6 +268,14 @@ describe PermittedParams, type: :model do params = ActionController::Parameters.new expect(PermittedParams.new(params, user).time_entry).to eq({}) end + + it 'should permit custom field values' do + hash = { 'custom_field_values' => { '1' => '5' } } + + params = ActionController::Parameters.new(version: hash) + + expect(PermittedParams.new(params, user).version).to eq(hash) + end end describe '#message' do