Avoid passing the current_user.id when commenting

Doing so doesn't appear to be necessary, and it opens up a spoofing
hole if it's actually used.

diff --git a/app/views/issues/_comments.html.erb b/app/views/issues/_comments.html.erb
index 6c684c253b190a7c8899df9ba6fd297506b06060..6e0f241b29f1c51c20d0af06ee309f0000f62a3d 100644 (file)
--- a/app/views/issues/_comments.html.erb
+++ b/app/views/issues/_comments.html.erb
@@ -20,7 +20,7 @@
 </div>
 <br/>
 <div class="comment">
 </div>
 <br/>
 <div class="comment">

-  <%= form_for :issue_comment, :url => { :action => 'comment', :id => @issue.id, :user_id => current_user.id } do |f| %>
+  <%= form_for :issue_comment, :url => { :action => 'comment', :id => @issue.id } do |f| %>

   <%= richtext_area :issue_comment, :body, :cols => 10, :rows => 8, :required => true %>
   <%= label_tag t('issues.show.comments.reassign_param') %> <%= check_box_tag :reassign, true %>
   <br/>
   <%= richtext_area :issue_comment, :body, :cols => 10, :rows => 8, :required => true %>
   <%= label_tag t('issues.show.comments.reassign_param') %> <%= check_box_tag :reassign, true %>
   <br/>