diff --git a/lib/redmine/safe_attributes.rb b/lib/redmine/safe_attributes.rb index 6f87a233cb0f954b40ac1fc1519b598698fed765..13db6a4505722e041443dceacd1ff6057464614f 100644 --- a/lib/redmine/safe_attributes.rb +++ b/lib/redmine/safe_attributes.rb @@ -31,14 +31,19 @@ module Redmine def safe_attributes(*args) @safe_attributes ||= [] if args.empty? - @safe_attributes + if superclass < Redmine::SafeAttributes + superclass.safe_attributes + @safe_attributes + else + @safe_attributes + end else options = args.last.is_a?(Hash) ? args.pop : {} @safe_attributes << [args, options] + safe_attributes end end end - + # Returns an array that can be safely set by user or current user # # Example: @@ -62,7 +67,7 @@ module Redmine # # => {'title' => 'My book'} def delete_unsafe_attributes(attrs, user=User.current) safe = safe_attribute_names(user) - attrs.dup.delete_if {|k,v| !safe.include?(k)} + attrs.dup.delete_if {|k,v| !safe.include?(k.to_s)} end # Sets attributes from attrs that are safe diff --git a/test/unit/lib/redmine/safe_attributes_test.rb b/test/unit/lib/redmine/safe_attributes_test.rb index 9498a438e7ad5e091b1e2c726b3ed491a97efccf..195b4446290e96ce14ba6ef7cf62788063b8b81b 100644 --- a/test/unit/lib/redmine/safe_attributes_test.rb +++ b/test/unit/lib/redmine/safe_attributes_test.rb @@ -35,11 +35,16 @@ class Redmine::SafeAttributesTest < ActiveSupport::TestCase end class Book < Base - attr_accessor :title + attr_accessor :title, :isbn include Redmine::SafeAttributes safe_attributes :title end + + class PublishedBook < Book + safe_attributes :isbn + end + def test_safe_attribute_names p = Person.new assert_equal ['firstname', 'lastname'], p.safe_attribute_names(User.anonymous) @@ -84,4 +89,25 @@ class Redmine::SafeAttributesTest < ActiveSupport::TestCase assert_equal 'Smith', p.lastname assert_equal 'jsmith', p.login end + + def test_with_indifferent_access + p = Person.new + p.safe_attributes = {'firstname' => 'Jack', :lastname => 'Miller'} + assert_equal 'Jack', p.firstname + assert_equal 'Miller', p.lastname + end + + def test_use_safe_attributes_in_subclasses + b = Book.new + p = PublishedBook.new + + b.safe_attributes = {'title' => 'My awesome Ruby Book', 'isbn' => '1221132343'} + p.safe_attributes = {'title' => 'The Pickaxe', 'isbn' => '1934356085'} + + assert_equal 'My awesome Ruby Book', b.title + assert_nil b.isbn + + assert_equal 'The Pickaxe', p.title + assert_equal '1934356085', p.isbn + end end