diff options
| author | Vijay Dev <vijaydev.cse@gmail.com> | 2012-05-12 19:10:49 +0530 |
|---|---|---|
| committer | Vijay Dev <vijaydev.cse@gmail.com> | 2012-05-12 19:10:49 +0530 |
| commit | 70237e7dd3dde34dd4b7849619457bcb214ff674 (patch) | |
| tree | 660564946242a4307621b0ff397a87a0add398e2 /guides/source/security.textile | |
| parent | f2f6534272b7895aa39183890043bc8c8e0ee1e8 (diff) | |
| parent | 84d198b4a0846ae74ff49001adaa7c3c80bc0607 (diff) | |
| download | rails-70237e7dd3dde34dd4b7849619457bcb214ff674.tar.gz rails-70237e7dd3dde34dd4b7849619457bcb214ff674.tar.bz2 rails-70237e7dd3dde34dd4b7849619457bcb214ff674.zip | |
Merge branch 'master' of github.com:lifo/docrails
Conflicts:
activesupport/lib/active_support/callbacks.rb
Diffstat (limited to 'guides/source/security.textile')
| -rw-r--r-- | guides/source/security.textile | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.textile b/guides/source/security.textile index ac64b82bf6..ac55d60368 100644 --- a/guides/source/security.textile +++ b/guides/source/security.textile @@ -627,7 +627,7 @@ h4. Whitelists versus Blacklists -- _When sanitizing, protecting or verifying something, whitelists over blacklists._ -A blacklist can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a whitelist which lists the good e-mail addresses, public actions, good HTML tags and so on. Although, sometimes it is not possible to create a whitelist (in a SPAM filter, for example), _(highlight)prefer to use whitelist approaches_: +A blacklist can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a whitelist which lists the good e-mail addresses, public actions, good HTML tags and so on. Although sometimes it is not possible to create a whitelist (in a SPAM filter, for example), _(highlight)prefer to use whitelist approaches_: * Use before_filter :only => [...] instead of :except => [...]. This way you don't forget to turn it off for newly added actions. * Use attr_accessible instead of attr_protected. See the mass-assignment section for details |