Skip to content

O
OHR Support
Commit f12b9fca authored by Jean-Philippe Lang's avatar Jean-Philippe Lang Committed by Holger Just
Browse files
Options

Prevent mass-assignment vulnerability when adding a project member (#922).

parent 296b3173
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 5 deletions
app/controllers/members_controller.rb
View file @ f12b9fca
...@@ -21,17 +21,19 @@ class MembersController < ApplicationController ...@@ -21,17 +21,19 @@ class MembersController < ApplicationController
def new def new
members = [] members = []
if params[:member] && request.post? if params[:member]
attrs = params[:member].dup if params[:member][:user_ids]
if (user_ids = attrs.delete(:user_ids)) attrs = params[:member].dup
user_ids = attrs.delete(:user_ids)
user_ids.each do |user_id| user_ids.each do |user_id|
members << Member.new(attrs.merge(:user_id => user_id)) members << Member.new(:role_ids => params[:member][:role_ids], :user_id => user_id)
end end
else else
members << Member.new(attrs) members << Member.new(:role_ids => params[:member][:role_ids], :user_id => params[:member][:user_id])
end end
@project.members << members @project.members << members
end end
respond_to do |format| respond_to do |format|
if members.present? && members.all? {|m| m.valid? } if members.present? && members.all? {|m| m.valid? }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment