3721 Commits (cc935aefd80c57ada2ad951758c92a3510d8d486)

Author	SHA1	Message	Date
Jean-Philippe Lang	6b25085997	Prevent mass-assignment vulnerability when adding/updating an issue category (#922).	13 years ago
Jean-Philippe Lang	21c498557e	Prevent mass-assignment vulnerability when adding/updating a document (#922). ... Conflicts: app/controllers/documents_controller.rb	13 years ago
Jens Ulferts	0c6ddd8030	adding comment	13 years ago
Jens Ulferts	1d1f923306	fixing minor bugs in custom_field: ... * remembering is_required before setting it in validation * no longer YAML.loading for attribute as serialization is handled in the translation table	13 years ago
Jens Ulferts	13813195e9	moving validates_uniqueness_of patch for globalized models into initializers	13 years ago
Jens Ulferts	911682f55c	validate default_value in every provided locale	13 years ago
Jens Ulferts	4e07a913c9	possible_values of custom_fields are now localizable	13 years ago
Jens Ulferts	74c9bc2896	enabling default_value of custom_fields to be localized by admins ... * tabular_form_builder also accepts :single_locale option which will cause the builder to generate a field based on the english localization. There will be no option to add or delete localizations for this field. Doing this means that the field will be equal accross all languages as en is always the default fallback	13 years ago
Jens Ulferts	7178c1b3b7	enabling name attribute of custom_fields to be localized by admins ... * using globalize2 for backend * overriding some AR methods in CustomField in order for them to work * with globalize ** validates_uniqueness_of works on translations table now. Should not be necessary any more when switching to globalize3 ** translations_attributes setter method as globalize2 does not work with nested_attributes by default * extending the tabular_form_builder to generate localizable attributes * as soon as :multi_locale => true is passed on a field	13 years ago
Gregor Schmidt	020779db95	Protect VersionSetting from mass assignment vulnerability ... project (not project_id) is still mass-assignable since we may assume, that project may not be changed via form manipulation	13 years ago
Gregor Schmidt	32fa28cb0e	clearing status id so that a proper error message is generated	13 years ago
Gregor Schmidt	d7f3c14255	avoid the usage of update_attributes and use safe_attributes instead ... this is indirectly done anyway - but why not make it explicit	13 years ago
Gregor Schmidt	61936a8475	Avoiding update_attributes and new for Issues ... Using safe_attributes= from core instead to avoid mass assignment vulnerability	13 years ago
jwollert	dc8483b15d	fixes copying projects	13 years ago
jwollert	3eca274548	fixes creation of member_roles	13 years ago
jwollert	934d22ec67	protect relations to users (assigned_to, author_id etc.) in models, too	13 years ago
Jens Ulferts	1c1a7c9d84	refactored allowed_to to be more extensible ... * AllowanceEvaluator can be registered to decide whether to grant or deny a permission request * default AllowanceEvaluator is functionally identical with former impelmentation * broken up allowed_to into allowed_to_for_project and allowed_to_globally to reduce method length	13 years ago
Martin Linkhorst	4e9c17fca8	some documentation regarding mass assignment, show full stack trace in console	13 years ago
Martin Linkhorst	bfc4a441f4	fix: use the old style #force_attributes	13 years ago
Martin Linkhorst	7b34ebdc47	refactor dealing with mass assignment	13 years ago
Martin Linkhorst	c7e130f010	fix to work with protected :project_id	13 years ago
jwollert	4fb1888965	fixes creation of anonymous user. shouldn't mass assign protected attributes (i.e. login)	13 years ago
Martin Linkhorst	009dc110a4	don't show multiple issue status in backlog, fixes #25703	13 years ago
Martin Linkhorst	cc74c1e998	added attr_protected calls to protect mass assignment of :project_id through a view	13 years ago
Martin Linkhorst	fcac419324	better locking info. issue #25606	13 years ago
Martin Linkhorst	dbb1f10d6b	fix: use old version instead	13 years ago
Martin Linkhorst	3c5aaeeb77	localize email headers and footers based on I18n.fallbacks	13 years ago
Romano Licker	17810216b0	having a fix call order resolves a problem where ... 'value=' was called before 'name=' resulting in no serialization	13 years ago
Romano Licker	d29112203b	fixes recreating initial journals ... the method now uses the acts_as_journalized methods when recreating the initial journal and tries to use existing journals for rebuilding the history	13 years ago
Romano Licker	d2d21388ae	having a fix call order resolves a problem where ... 'value=' was called before 'name=' resulting in no serialization	13 years ago
Martin Linkhorst	41bc805585	control headers and footers of emails in all languages	13 years ago
Romano Licker	3506a0327f	journalize parent_id on issues	13 years ago
Martin Linkhorst	a11ff6abdc	made emails to use the correct language	13 years ago
Jens Ulferts	5027a42a8d	acts_as_journalized for variable_cost_object ... * removed from cost_object as acts_as_journalized does not play well with subclasses * create migration for recreating initial journals	13 years ago
Jens Ulferts	cdb2e8e54d	change empty line coding	13 years ago
Eric Davis	c5e4ab41c7	[#674] Convert outbound mail to be sent per-recipient ... Instead of a single email that is sent out with all the recipients as CC/BCC, each recipient will be delivered their own email. This will let emails to be customized per user based on their permissions, without exposing private data.	13 years ago
Jens Ulferts	2ae0236a46	serialize costtypeid so that it can be saved	13 years ago
Gregor Schmidt	88ab906fab	Anonymous users are always considered impaired	13 years ago
Gregor Schmidt	b65160c936	Less coupled fix for 7632483c - initial journal handling ... New named scope allows exclusion of initial journals from list, so that there is no need to handle them separately	13 years ago
Gregor Schmidt	81392aec69	Switch to using string keys for settings ... This seems to be more robust than the nicer symbol ones, esp. when using Ruby 1.9 Fixes #3	13 years ago
Gregor Schmidt	d76fd8e499	[#780] using a changing cache key to avoid the need for explicit cache invalidation ... This should work on all cache stores, since only the basic cache operations fetch and delete are used. The methods clear_cache and check_cache can no longer be supported. To sweep the whole cache Rails.cache.clear may be used. To invalidate the Settings only, you may use Setting.first.try(:touch).	13 years ago
Romano Licker	40a17fc0b0	adding validations ... fixing existing validation fixing view which breaks when error occurred fixing error messages fixing missing translations	13 years ago
jwollert	a32e5d23cc	fixes translation bug causing new elements to have faulty titles	13 years ago
jwollert	9185e7137e	use h3 as standard heading, just like all other blocks do.	13 years ago
Jens Ulferts	9d16f8def3	fix: only set default blocks on initializing a new overview and only when no blocks are provided	13 years ago
Tim Felgentreff	7be0043fb9	license notice for code files, at least	13 years ago
Tim Felgentreff	acb1428cdd	fix handling of default values for project overview pages	13 years ago
Tim Felgentreff	5fe28bf6b0	[DTAG #16506] Increase the maximum length of teaser widget texts by storing in a blob instead of string	13 years ago
Gregor Schmidt	bf054c4f9c	Adding field to store user preference for impaired view ... Also adding field to store, if the user has already seen the first_login page, where s/he is asked, whether or not s/he would like to use the 'impair-optimized' version	13 years ago
Felix Schäfer	1050eb6642	Make the model unloadable ... Avoids reloader-related crashes in development.	13 years ago