diff app/controllers/news_controller.rb @ 929:5f33065ddc4b redmine-1.3

Update to Redmine SVN rev 9414 on 1.3-stable branch

--- a/app/controllers/news_controller.rb	Fri Feb 24 19:09:32 2012 +0000
+++ b/app/controllers/news_controller.rb	Wed Jun 27 14:54:18 2012 +0100
@@ -67,8 +67,8 @@
 
   def create
     @news = News.new(:project => @project, :author => User.current)
+    @news.safe_attributes = params[:news]
     if request.post?
-      @news.attributes = params[:news]
       if @news.save
         flash[:notice] = l(:notice_successful_create)
         redirect_to :controller => 'news', :action => 'index', :project_id => @project
@@ -82,7 +82,8 @@
   end
 
   def update
-    if request.put? and @news.update_attributes(params[:news])
+    @news.safe_attributes = params[:news]
+    if request.put? and @news.save
       flash[:notice] = l(:notice_successful_update)
       redirect_to :action => 'show', :id => @news
     else