Commit 0bc3067e authored by jplang's avatar jplang

Wrap journal attributes with a journal parameter and use safe_attributes (#22575).

git-svn-id: https://svn.redmine.org/redmine/trunk@15621 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent 1045e55b
......@@ -90,10 +90,8 @@ class JournalsController < ApplicationController
def update
(render_403; return false) unless @journal.editable_by?(User.current)
@journal.notes = params[:notes] if params[:notes]
@journal.private_notes = params[:private_notes].present?
(render_403; return false) if @journal.private_notes_changed? && User.current.allowed_to?(:set_notes_private, @journal.issue.project) == false
@journal.save if @journal.changed?
@journal.safe_attributes = params[:journal]
@journal.save
@journal.destroy if @journal.details.empty? && @journal.notes.blank?
call_hook(:controller_journals_edit_post, { :journal => @journal, :params => params})
respond_to do |format|
......
......@@ -45,7 +45,7 @@ module JournalsHelper
:class => 'icon-only icon-edit'
) if editable
links << link_to(l(:button_delete),
journal_path(journal, :notes => ""),
journal_path(journal, :journal => {:notes => ""}),
:remote => true,
:method => 'put', :data => {:confirm => l(:text_are_you_sure)},
:title => l(:button_delete),
......
......@@ -16,6 +16,8 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class Journal < ActiveRecord::Base
include Redmine::SafeAttributes
belongs_to :journalized, :polymorphic => true
# added as a quick fix to allow eager loading of the polymorphic association
# since always associated to an issue, for now
......@@ -50,6 +52,11 @@ class Journal < ActiveRecord::Base
where("(#{Journal.table_name}.private_notes = ? OR (#{Project.allowed_to_condition(user, :view_private_notes, *args)}))", false)
}
safe_attributes 'notes',
:if => lambda {|journal, user| journal.new_record? || journal.editable_by?(user)}
safe_attributes 'private_notes',
:if => lambda {|journal, user| user.allowed_to?(:set_notes_private, journal.project)}
def initialize(*args)
super
if journalized
......
......@@ -3,12 +3,14 @@
:method => 'put',
:id => "journal-#{@journal.id}-form") do %>
<%= label_tag "notes", l(:description_notes), :class => "hidden-for-sighted" %>
<%= text_area_tag :notes, @journal.notes,
<%= text_area_tag 'journal[notes]', @journal.notes,
:id => "journal_#{@journal.id}_notes",
:class => 'wiki-edit',
:rows => (@journal.notes.blank? ? 10 : [[10, @journal.notes.length / 50].max, 100].min) %>
<% if @journal.issue.safe_attribute? 'private_notes' %>
<%= check_box_tag 'private_notes', '1', @journal.private_notes, :id => "journal_#{@journal.id}_private_notes" %> <label for="journal_<%= @journal.id %>_private_notes"><%= l(:field_private_notes) %></label>
<% if @journal.safe_attribute? 'private_notes' %>
<%= hidden_field_tag 'journal[private_notes]', '0' %>
<%= check_box_tag 'journal[private_notes]', '1', @journal.private_notes, :id => "journal_#{@journal.id}_private_notes" %>
<label for="journal_<%= @journal.id %>_private_notes"><%= l(:field_private_notes) %></label>
<% end %>
<%= call_hook(:view_journals_notes_form_after_notes, { :journal => @journal}) %>
<p><%= submit_tag l(:button_save) %>
......
......@@ -199,7 +199,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr
@request.session[:user_id] = 1
xhr :post, :update, :id => 2, :notes => 'Updated notes'
xhr :post, :update, :id => 2, :journal => {:notes => 'Updated notes'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
......@@ -209,7 +209,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr_with_private_notes_checked
@request.session[:user_id] = 1
xhr :post, :update, :id => 2, :private_notes => '1'
xhr :post, :update, :id => 2, :journal => {:private_notes => '1'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
......@@ -221,7 +221,7 @@ class JournalsControllerTest < ActionController::TestCase
def test_update_xhr_with_private_notes_unchecked
Journal.find(2).update_attributes(:private_notes => true)
@request.session[:user_id] = 1
xhr :post, :update, :id => 2
xhr :post, :update, :id => 2, :journal => {:private_notes => '0'}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
......@@ -230,20 +230,21 @@ class JournalsControllerTest < ActionController::TestCase
assert_include 'journal-2-private_notes', response.body
end
def test_update_xhr_with_private_notes_changes_and_without_set_private_notes_permission
def test_update_xhr_without_set_private_notes_permission_should_ignore_private_notes
@request.session[:user_id] = 2
Role.find(1).add_permission! :edit_issue_notes
Role.find(1).add_permission! :view_private_notes
Role.find(1).remove_permission! :set_notes_private
xhr :post, :update, :id => 2, :private_notes => '1'
assert_response 403
xhr :post, :update, :id => 2, :journal => {:private_notes => '1'}
assert_response :success
assert_equal false, Journal.find(2).private_notes
end
def test_update_xhr_with_empty_notes_should_delete_the_journal
@request.session[:user_id] = 1
assert_difference 'Journal.count', -1 do
xhr :post, :update, :id => 2, :notes => ''
xhr :post, :update, :id => 2, :journal => {:notes => ''}
assert_response :success
assert_template 'update'
assert_equal 'text/javascript', response.content_type
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment