Merge pull request #160 from publify/limit-admin-article-params

Use known set of allowed attributes when autosaving an Article
publify · Oct 13, 2024 · a350c86 · a350c86
2 parents 67e1531 + 0a84738
commit a350c86
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/controllers/admin/articles_controller.rb b/app/controllers/admin/articles_controller.rb
@@ -108,7 +108,7 @@ def autosave
 
     fetch_fresh_or_existing_draft_for_article
 
-    @article.attributes = params[:article].permit!
+    @article.assign_attributes(update_params)
 
     @article.author = current_user
     @article.save_attachments!(params[:attachments])