aboutsummaryrefslogtreecommitdiffstats
path: root/guides
diff options
context:
space:
mode:
authorAlfonso Cora <acora6@gmail.com>2012-04-12 12:20:12 -0300
committerAlfonso Cora <acora6@gmail.com>2012-04-12 12:20:12 -0300
commit05ac3921f85663416fe8a4287b05db3284276b24 (patch)
tree08c8ad44b91fdaba1a06a291bdae557afa191ed3 /guides
parent63bd01d82fb4b4f62a6842db5edcd60a60efa964 (diff)
downloadrails-05ac3921f85663416fe8a4287b05db3284276b24.tar.gz
rails-05ac3921f85663416fe8a4287b05db3284276b24.tar.bz2
rails-05ac3921f85663416fe8a4287b05db3284276b24.zip
Fixed markup in security guide
Diffstat (limited to 'guides')
-rw-r--r--guides/source/security.textile2
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.textile b/guides/source/security.textile
index 747a4d6791..c065529cac 100644
--- a/guides/source/security.textile
+++ b/guides/source/security.textile
@@ -385,7 +385,7 @@ params[:user] # => {:name => “ow3ned”, :admin => true}
So if you create a new user using mass-assignment, it may be too easy to become an administrator.
-Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3<plus>. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
+Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
<ruby>
class Person < ActiveRecord::Base