diff options
| author | José Valim <jose.valim@gmail.com> | 2011-08-01 04:50:06 -0700 |
|---|---|---|
| committer | José Valim <jose.valim@gmail.com> | 2011-08-01 04:50:06 -0700 |
| commit | 6b3af028acdd8c97b7b6088117a042ddfd7f3038 (patch) | |
| tree | d70bff398e2702b7d8cea400f9b2d56be3dd28a1 /activemodel/lib/active_model | |
| parent | 860202e8b2e3579402d48d7e56fa738a9529a340 (diff) | |
| parent | b93a918337e99c3fe3ad059f093b1ee56b9e6a7d (diff) | |
| download | rails-6b3af028acdd8c97b7b6088117a042ddfd7f3038.tar.gz rails-6b3af028acdd8c97b7b6088117a042ddfd7f3038.tar.bz2 rails-6b3af028acdd8c97b7b6088117a042ddfd7f3038.zip | |
Merge pull request #2385 from bogdan/test_default_sanitizer2
MassAssignmentProtection: consider 'id' insensetive in StrictSanitizer
Diffstat (limited to 'activemodel/lib/active_model')
| -rw-r--r-- | activemodel/lib/active_model/mass_assignment_security/sanitizer.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb index bb0526adc3..bbdddfb50d 100644 --- a/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb +++ b/activemodel/lib/active_model/mass_assignment_security/sanitizer.rb @@ -44,8 +44,13 @@ module ActiveModel class StrictSanitizer < Sanitizer def process_removed_attributes(attrs) + return if (attrs - insensitive_attributes).empty? raise ActiveModel::MassAssignmentSecurity::Error, "Can't mass-assign protected attributes: #{attrs.join(', ')}" end + + def insensitive_attributes + ['id'] + end end class Error < StandardError |