diff --git a/app/controllers/traces_controller.rb b/app/controllers/traces_controller.rb
index ab4c8f3b8..31ce88ec3 100644
--- a/app/controllers/traces_controller.rb
+++ b/app/controllers/traces_controller.rb
@@ -175,13 +175,24 @@ class TracesController < ApplicationController
head :forbidden
else
@title = t ".title", :name => @trace.name
+ end
+ rescue ActiveRecord::RecordNotFound
+ head :not_found
+ end
- if request.post? && params[:trace]
- @trace.description = params[:trace][:description]
- @trace.tagstring = params[:trace][:tagstring]
- @trace.visibility = params[:trace][:visibility]
- redirect_to :action => "view", :display_name => current_user.display_name if @trace.save
- end
+ def update
+ @trace = Trace.find(params[:id])
+
+ if !@trace.visible?
+ head :not_found
+ elsif current_user.nil? || @trace.user != current_user
+ head :forbidden
+ elsif @trace.update(trace_params)
+ flash[:notice] = t ".updated"
+ redirect_to :action => "view", :display_name => current_user.display_name
+ else
+ @title = t ".title", :name => @trace.name
+ render :action => "edit"
end
rescue ActiveRecord::RecordNotFound
head :not_found
@@ -413,4 +424,8 @@ class TracesController < ApplicationController
"public"
end
end
+
+ def trace_params
+ params.require(:trace).permit(:description, :tagstring, :visibility)
+ end
end
diff --git a/app/views/traces/edit.html.erb b/app/views/traces/edit.html.erb
index 6657a33ad..b5b4a84d6 100644
--- a/app/views/traces/edit.html.erb
+++ b/app/views/traces/edit.html.erb
@@ -4,7 +4,7 @@
-<%= form_for @trace, :method => :post, :url => { :action => "edit" } do |f| %>
+<%= form_for @trace do |f| %>