diff options
author | Bogdan Gusiev <agresso@gmail.com> | 2011-07-28 11:56:08 +0300 |
---|---|---|
committer | Xavier Noria <fxn@hashref.com> | 2011-08-13 16:22:26 -0700 |
commit | f86f7702507f477eb8f0a8e914bdb53219fac953 (patch) | |
tree | 47fb43aa64e25c8deb6768a5eb146c45f2db145f /activemodel/lib/active_model | |
parent | 5f3265c4714efd697cb71015489a9c59d1129440 (diff) | |
download | rails-f86f7702507f477eb8f0a8e914bdb53219fac953.tar.gz rails-f86f7702507f477eb8f0a8e914bdb53219fac953.tar.bz2 rails-f86f7702507f477eb8f0a8e914bdb53219fac953.zip |
MassAssignmentProtection: consider 'id' insensetive in StrictSanitizer
In order to use StrictSanitizer in test mode
Consider :id as not sensetive attribute that can be filtered from
mass assignement without exception.
Diffstat (limited to 'activemodel/lib/active_model')
-rw-r--r-- | activemodel/lib/active_model/mass_assignment_security/sanitizer.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb index bb0526adc3..bbdddfb50d 100644 --- a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb +++ b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb @@ -44,8 +44,13 @@ module ActiveModel class StrictSanitizer < Sanitizer def process_removed_attributes(attrs) + return if (attrs - insensitive_attributes).empty? raise ActiveModel::MassAssignmentSecurity::Error, "Can't mass-assign protected attributes: #{attrs.join(', ')}" end + + def insensitive_attributes + ['id'] + end end class Error < StandardError |