From 985c885f98497871fdf1bd4f7d64f79c0046a9a6 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Wed, 7 Mar 2012 18:30:46 +0000
Subject: [PATCH] Backported r9134 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.3-stable@9151 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/controllers/news_controller.rb | 5 +++--
 app/models/news.rb                 | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/controllers/news_controller.rb b/app/controllers/news_controller.rb
index 0d091396a..27e16afa4 100644
--- a/app/controllers/news_controller.rb
+++ b/app/controllers/news_controller.rb
@@ -67,8 +67,8 @@ class NewsController < ApplicationController
 
   def create
     @news = News.new(:project => @project, :author => User.current)
+    @news.safe_attributes = params[:news]
     if request.post?
-      @news.attributes = params[:news]
       if @news.save
         flash[:notice] = l(:notice_successful_create)
         redirect_to :controller => 'news', :action => 'index', :project_id => @project
@@ -82,7 +82,8 @@ class NewsController < ApplicationController
   end
 
   def update
-    if request.put? and @news.update_attributes(params[:news])
+    @news.safe_attributes = params[:news]
+    if request.put? and @news.save
       flash[:notice] = l(:notice_successful_update)
       redirect_to :action => 'show', :id => @news
     else
diff --git a/app/models/news.rb b/app/models/news.rb
index 551568fd0..1985754bc 100644
--- a/app/models/news.rb
+++ b/app/models/news.rb
@@ -16,6 +16,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class News < ActiveRecord::Base
+  include Redmine::SafeAttributes
   belongs_to :project
   belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
   has_many :comments, :as => :commented, :dependent => :delete_all, :order => "created_on"
@@ -37,6 +38,8 @@ class News < ActiveRecord::Base
     :conditions => Project.allowed_to_condition(args.shift || User.current, :view_news, *args)
   }}
 
+  safe_attributes 'title', 'summary', 'description'
+
   def visible?(user=User.current)
     !user.nil? && user.allowed_to?(:view_news, project)
   end