aboutsummaryrefslogtreecommitdiffstats
path: root/activerecord
diff options
context:
space:
mode:
authorRafael Mendonça França <rafaelmfranca@gmail.com>2012-11-22 06:47:44 -0800
committerRafael Mendonça França <rafaelmfranca@gmail.com>2012-11-22 06:47:44 -0800
commit83e71051258b98bd5c4df80b321c7b690ddcab35 (patch)
treec40be8c2333aaba0928e41407e0fd2ac0442809c /activerecord
parent4e00e8e91637e117f702ec277a5db1fd087cb347 (diff)
parentd397a38c0268e61295e23f617e9bf70d905ea610 (diff)
downloadrails-83e71051258b98bd5c4df80b321c7b690ddcab35.tar.gz
rails-83e71051258b98bd5c4df80b321c7b690ddcab35.tar.bz2
rails-83e71051258b98bd5c4df80b321c7b690ddcab35.zip
Merge pull request #8295 from senny/8265_backport
backport #8291, prevent mass assignment of polymorphic type with `build`
Diffstat (limited to 'activerecord')
-rw-r--r--activerecord/CHANGELOG.md5
-rw-r--r--activerecord/lib/active_record/associations/association.rb3
-rw-r--r--activerecord/test/cases/associations/has_many_associations_test.rb8
3 files changed, 15 insertions, 1 deletions
diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md
index 2de834ff34..78346d8586 100644
--- a/activerecord/CHANGELOG.md
+++ b/activerecord/CHANGELOG.md
@@ -1,5 +1,10 @@
## Rails 3.2.10 (unreleased)
+* Prevent mass assignment to the type column of polymorphic associations when using `build` [Backport #8291]
+ Fix #8265
+
+ *Yves Senn*
+
* When running migrations on Postgresql, the `:limit` option for `binary` and `text` columns is silently dropped.
Previously, these migrations caused sql exceptions, because Postgresql doesn't support limits on these types.
diff --git a/activerecord/lib/active_record/associations/association.rb b/activerecord/lib/active_record/associations/association.rb
index 59c1bad559..ab0d888b16 100644
--- a/activerecord/lib/active_record/associations/association.rb
+++ b/activerecord/lib/active_record/associations/association.rb
@@ -231,7 +231,8 @@ module ActiveRecord
def build_record(attributes, options)
reflection.build_association(attributes, options) do |record|
- attributes = create_scope.except(*(record.changed - [reflection.foreign_key]))
+ skip_assign = [reflection.foreign_key, reflection.type].compact
+ attributes = create_scope.except(*(record.changed - skip_assign))
record.assign_attributes(attributes, :without_protection => true)
end
end
diff --git a/activerecord/test/cases/associations/has_many_associations_test.rb b/activerecord/test/cases/associations/has_many_associations_test.rb
index c311bf70d2..b4788e0a3d 100644
--- a/activerecord/test/cases/associations/has_many_associations_test.rb
+++ b/activerecord/test/cases/associations/has_many_associations_test.rb
@@ -1704,6 +1704,14 @@ class HasManyAssociationsTest < ActiveRecord::TestCase
assert_equal [tagging], post.taggings
end
+ def test_build_with_polymotphic_has_many_does_not_allow_to_override_type_and_id
+ welcome = posts(:welcome)
+ tagging = welcome.taggings.build(:taggable_id => 99, :taggable_type => 'ShouldNotChange')
+
+ assert_equal welcome.id, tagging.taggable_id
+ assert_equal 'Post', tagging.taggable_type
+ end
+
def test_dont_call_save_callbacks_twice_on_has_many
firm = companies(:first_firm)
contract = firm.contracts.create!