Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
gitlab-ce
Commits
3c132f2e
Commit
3c132f2e
authored
12 years ago
by
Dmitriy Zaporozhets
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #1561 from dosire/mass_assignment
Protect users projects_limit from mass assignment.
parents
547be97b
5928388b
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
32 additions
and
5 deletions
+32
-5
app/controllers/admin/users_controller.rb
app/controllers/admin/users_controller.rb
+3
-3
app/models/user.rb
app/models/user.rb
+3
-2
spec/models/user_spec.rb
spec/models/user_spec.rb
+26
-0
No files found.
app/controllers/admin/users_controller.rb
View file @
3c132f2e
...
...
@@ -30,7 +30,7 @@ class Admin::UsersController < AdminController
def
new
@admin_user
=
User
.
new
(
projects_limit:
Gitlab
.
config
.
default_projects_limit
)
@admin_user
=
User
.
new
(
{
projects_limit:
Gitlab
.
config
.
default_projects_limit
},
as: :admin
)
end
def
edit
...
...
@@ -60,7 +60,7 @@ class Admin::UsersController < AdminController
def
create
admin
=
params
[
:user
].
delete
(
"admin"
)
@admin_user
=
User
.
new
(
params
[
:user
])
@admin_user
=
User
.
new
(
params
[
:user
]
,
as: :admin
)
@admin_user
.
admin
=
(
admin
&&
admin
.
to_i
>
0
)
respond_to
do
|
format
|
...
...
@@ -86,7 +86,7 @@ class Admin::UsersController < AdminController
@admin_user
.
admin
=
(
admin
&&
admin
.
to_i
>
0
)
respond_to
do
|
format
|
if
@admin_user
.
update_attributes
(
params
[
:user
])
if
@admin_user
.
update_attributes
(
params
[
:user
]
,
as: :admin
)
format
.
html
{
redirect_to
[
:admin
,
@admin_user
],
notice:
'User was successfully updated.'
}
format
.
json
{
head
:ok
}
else
...
...
This diff is collapsed.
Click to expand it.
app/models/user.rb
View file @
3c132f2e
...
...
@@ -6,8 +6,9 @@ class User < ActiveRecord::Base
:recoverable
,
:rememberable
,
:trackable
,
:validatable
,
:omniauthable
attr_accessible
:email
,
:password
,
:password_confirmation
,
:remember_me
,
:bio
,
:name
,
:projects_limit
,
:skype
,
:linkedin
,
:twitter
,
:dark_scheme
,
:theme_id
,
:force_random_password
,
:extern_uid
,
:provider
:name
,
:skype
,
:linkedin
,
:twitter
,
:dark_scheme
,
:theme_id
,
:force_random_password
,
:extern_uid
,
:provider
,
:as
=>
[
:default
,
:admin
]
attr_accessible
:projects_limit
,
:as
=>
:admin
attr_accessor
:force_random_password
...
...
This diff is collapsed.
Click to expand it.
spec/models/user_spec.rb
View file @
3c132f2e
...
...
@@ -73,4 +73,30 @@ describe User do
user
.
authentication_token
.
should_not
be_blank
end
end
describe
"attributes can be changed by a regular user"
do
before
do
@user
=
Factory
:user
@user
.
update_attributes
(
skype:
"testskype"
,
linkedin:
"testlinkedin"
)
end
it
{
@user
.
skype
.
should
==
'testskype'
}
it
{
@user
.
linkedin
.
should
==
'testlinkedin'
}
end
describe
"attributes that shouldn't be changed by a regular user"
do
before
do
@user
=
Factory
:user
@user
.
update_attributes
(
projects_limit:
50
)
end
it
{
@user
.
projects_limit
.
should_not
==
50
}
end
describe
"attributes can be changed by an admin user"
do
before
do
@admin_user
=
Factory
:admin
@admin_user
.
update_attributes
({
skype:
"testskype"
,
projects_limit:
50
},
as: :admin
)
end
it
{
@admin_user
.
skype
.
should
==
'testskype'
}
it
{
@admin_user
.
projects_limit
.
should
==
50
}
end
end
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment