diff options
| author | Oscar Del Ben <info@oscardelben.com> | 2012-05-14 13:56:26 -0700 |
|---|---|---|
| committer | Oscar Del Ben <info@oscardelben.com> | 2012-05-14 13:56:26 -0700 |
| commit | f2af398efa40dff20d4841d595bc0366660707cc (patch) | |
| tree | 8af0c081de5f2d6cfc1b033c5eefa9954de569dd /guides/source/security.textile | |
| parent | 59462c1e310b85569785cf5f491611e670c2755b (diff) | |
| parent | 151aa9abae131f1a03513f756aeaef2fc403f9bb (diff) | |
| download | rails-f2af398efa40dff20d4841d595bc0366660707cc.tar.gz rails-f2af398efa40dff20d4841d595bc0366660707cc.tar.bz2 rails-f2af398efa40dff20d4841d595bc0366660707cc.zip | |
Merge branch 'master' of github.com:lifo/docrails
Diffstat (limited to 'guides/source/security.textile')
| -rw-r--r-- | guides/source/security.textile | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.textile b/guides/source/security.textile index ac64b82bf6..ac55d60368 100644 --- a/guides/source/security.textile +++ b/guides/source/security.textile @@ -627,7 +627,7 @@ h4. Whitelists versus Blacklists -- _When sanitizing, protecting or verifying something, whitelists over blacklists._ -A blacklist can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a whitelist which lists the good e-mail addresses, public actions, good HTML tags and so on. Although, sometimes it is not possible to create a whitelist (in a SPAM filter, for example), _(highlight)prefer to use whitelist approaches_: +A blacklist can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a whitelist which lists the good e-mail addresses, public actions, good HTML tags and so on. Although sometimes it is not possible to create a whitelist (in a SPAM filter, for example), _(highlight)prefer to use whitelist approaches_: * Use before_filter :only => [...] instead of :except => [...]. This way you don't forget to turn it off for newly added actions. * Use attr_accessible instead of attr_protected. See the mass-assignment section for details |