19316: Change wb1 and sdk/cli to Oj.safe_load / strict_load.

[arvados.git] / apps / workbench / app / controllers / actions_controller.rb

diff --git a/apps/workbench/app/controllers/actions_controller.rb b/apps/workbench/app/controllers/actions_controller.rb
index 3667d8acaa5975fdb9c2bec62e1572667f13e680..7b8c8eafc81d31cd566c6cef81e050b5ca521c9a 100644 (file)
--- a/apps/workbench/app/controllers/actions_controller.rb
+++ b/apps/workbench/app/controllers/actions_controller.rb
@@ -87,6 +87,9 @@ class ActionsController < ApplicationController
             end
             if resource_class == Collection
               dst.manifest_text = Collection.select([:manifest_text]).where(uuid: src.uuid).with_count("none").first.manifest_text
+              # Fixes bug 19144: nullify some fields that are managed by keep-balance.
+              dst.storage_classes_confirmed = []
+              dst.storage_classes_confirmed_at = nil
             end
           when :move
             dst = src
@@ -164,7 +167,7 @@ class ActionsController < ApplicationController
     flash = {}
 
     # set owner_uuid to current project, provided it is writable
-    action_data = Oj.load(params['action_data'] || "{}")
+    action_data = Oj.safe_load(params['action_data'] || "{}")
     if action_data['current_project_uuid'] and
         current_project = Group.find?(action_data['current_project_uuid']) and
         current_project.writable_by.andand.include?(current_user.uuid)