deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #1561 from dosire/mass_assignment

Browse source 
Protect users projects_limit from mass assignment.
This commit is contained in:
Dmitriy Zaporozhets 2012-09-26 05:45:16 -07:00
commit 3c132f2e68
3 changed files with 32 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/admin/users_controller.rb
View file

@ -30,7 +30,7 @@ class Admin::UsersController < AdminController
def new
@admin_user = User.new(projects_limit: Gitlab.config.default_projects_limit)
@admin_user = User.new({ projects_limit: Gitlab.config.default_projects_limit }, as: :admin)
end
def edit
@ -60,7 +60,7 @@ class Admin::UsersController < AdminController
def create
admin = params[:user].delete("admin")
@admin_user = User.new(params[:user])
@admin_user = User.new(params[:user], as: :admin)
@admin_user.admin = (admin && admin.to_i > 0)
respond_to do |format|
@ -86,7 +86,7 @@ class Admin::UsersController < AdminController
@admin_user.admin = (admin && admin.to_i > 0)
respond_to do |format|
if @admin_user.update_attributes(params[:user])
if @admin_user.update_attributes(params[:user], as: :admin)
format.html { redirect_to [:admin, @admin_user], notice: 'User was successfully updated.' }
format.json { head :ok }
else