diff options
author | José Valim <jose.valim@gmail.com> | 2011-04-25 23:58:23 -0700 |
---|---|---|
committer | José Valim <jose.valim@gmail.com> | 2011-04-25 23:58:23 -0700 |
commit | b73c84eaa76da4386dc4b78cdfc75baf0a08f6f2 (patch) | |
tree | b5166a57393b723bf38377f4623fcee23987b1b4 /activerecord/lib/active_record/base.rb | |
parent | 3a109f78cd403e9257a5765b56ee9363deed0aa4 (diff) | |
parent | f9d5a7bb8c5d224f689dafb4ff641e2ced244f03 (diff) | |
download | rails-b73c84eaa76da4386dc4b78cdfc75baf0a08f6f2.tar.gz rails-b73c84eaa76da4386dc4b78cdfc75baf0a08f6f2.tar.bz2 rails-b73c84eaa76da4386dc4b78cdfc75baf0a08f6f2.zip |
Merged pull request #308 from joshk/assign_attributes.
deprecated the use of guard_protected_attributes with attributes= in AR
Diffstat (limited to 'activerecord/lib/active_record/base.rb')
-rw-r--r-- | activerecord/lib/active_record/base.rb | 23 |
1 files changed, 14 insertions, 9 deletions
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb index 4512e8c8ad..04c12f86b6 100644 --- a/activerecord/lib/active_record/base.rb +++ b/activerecord/lib/active_record/base.rb @@ -1621,11 +1621,11 @@ end # Allows you to set all the attributes at once by passing in a hash with keys # matching the attribute names (which again matches the column names). # - # If +guard_protected_attributes+ is true (the default), then sensitive - # attributes can be protected from this form of mass-assignment by using - # the +attr_protected+ macro. Or you can alternatively specify which - # attributes *can* be accessed with the +attr_accessible+ macro. Then all the - # attributes not included in that won't be allowed to be mass-assigned. + # If any attributes are protected by either +attr_protected+ or + # +attr_accessible+ then only settable attributes will be assigned. + # + # The +guard_protected_attributes+ argument is now deprecated, use + # the +assign_attributes+ method if you want to bypass mass-assignment security. # # class User < ActiveRecord::Base # attr_protected :is_admin @@ -1635,11 +1635,16 @@ end # user.attributes = { :username => 'Phusion', :is_admin => true } # user.username # => "Phusion" # user.is_admin? # => false - # - # user.send(:attributes=, { :username => 'Phusion', :is_admin => true }, false) - # user.is_admin? # => true - def attributes=(new_attributes, guard_protected_attributes = true) + def attributes=(new_attributes, guard_protected_attributes = nil) + unless guard_protected_attributes.nil? + message = "the use of 'guard_protected_attributes' will be removed from the next major release of rails, " + + "if you want to bypass mass-assignment security then look into using assign_attributes" + ActiveSupport::Deprecation.warn(message) + end + return unless new_attributes.is_a?(Hash) + + guard_protected_attributes ||= true if guard_protected_attributes assign_attributes(new_attributes) else |