aboutsummaryrefslogtreecommitdiffstats
path: root/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
diff options
context:
space:
mode:
authorBogdan Gusiev <agresso@gmail.com>2011-07-28 11:56:08 +0300
committerXavier Noria <fxn@hashref.com>2011-08-13 16:22:26 -0700
commitf86f7702507f477eb8f0a8e914bdb53219fac953 (patch)
tree47fb43aa64e25c8deb6768a5eb146c45f2db145f /activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
parent5f3265c4714efd697cb71015489a9c59d1129440 (diff)
downloadrails-f86f7702507f477eb8f0a8e914bdb53219fac953.tar.gz
rails-f86f7702507f477eb8f0a8e914bdb53219fac953.tar.bz2
rails-f86f7702507f477eb8f0a8e914bdb53219fac953.zip
MassAssignmentProtection: consider 'id' insensetive in StrictSanitizer
In order to use StrictSanitizer in test mode Consider :id as not sensetive attribute that can be filtered from mass assignement without exception.
Diffstat (limited to 'activemodel/lib/active_model/mass_assignment_security/sanitizer.rb')
-rw-r--r--activemodel/lib/active_model/mass_assignment_security/sanitizer.rb5
1 files changed, 5 insertions, 0 deletions
diff --git a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
index bb0526adc3..bbdddfb50d 100644
--- a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
+++ b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb
@@ -44,8 +44,13 @@ module ActiveModel
class StrictSanitizer < Sanitizer
def process_removed_attributes(attrs)
+ return if (attrs - insensitive_attributes).empty?
raise ActiveModel::MassAssignmentSecurity::Error, "Can't mass-assign protected attributes: #{attrs.join(', ')}"
end
+
+ def insensitive_attributes
+ ['id']
+ end
end
class Error < StandardError