diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-18 13:51:02 -0800 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-22 15:02:46 -0800 |
| commit | 4642d68d8021893c69bfd16ed6e926ae03a6d777 (patch) | |
| tree | be212b3810e264ca10cdf015d576773fa27f27ed /activerecord/lib/active_record/scoping | |
| parent | b7758b40fc035a47f6843158155606d455314c42 (diff) | |
| download | rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.gz rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.tar.bz2 rails-4642d68d8021893c69bfd16ed6e926ae03a6d777.zip | |
Eliminate instance level writers for class accessors
Instance level writers can have an impact on how the Active Model /
Record objects are saved. Specifically, they can be used to bypass
validations. This is a problem if mass assignment protection is
disabled and specific attributes are passed to the constructor.
CVE-2016-0753
Diffstat (limited to 'activerecord/lib/active_record/scoping')
| -rw-r--r-- | activerecord/lib/active_record/scoping/default.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/activerecord/lib/active_record/scoping/default.rb b/activerecord/lib/active_record/scoping/default.rb index cdcb73382f..c9f689ee17 100644 --- a/activerecord/lib/active_record/scoping/default.rb +++ b/activerecord/lib/active_record/scoping/default.rb @@ -6,7 +6,7 @@ module ActiveRecord included do # Stores the default scope for the class. class_attribute :default_scopes, instance_writer: false, instance_predicate: false - class_attribute :default_scope_override, instance_predicate: false + class_attribute :default_scope_override, instance_writer: false, instance_predicate: false self.default_scopes = [] self.default_scope_override = nil |