aboutsummaryrefslogtreecommitdiffstats
path: root/railties/guides/source/security.textile
diff options
context:
space:
mode:
authorJoseph Pecoraro <joepeck02@gmail.com>2009-05-29 16:26:50 -0400
committerJoseph Pecoraro <joepeck02@gmail.com>2009-05-29 16:26:50 -0400
commit3014f0f4c53da5b10294670976080b0036c016dd (patch)
treedb7e4a39be2f6f301bfadcd37f6779bae9137f2a /railties/guides/source/security.textile
parent796fef684bb9ab081c1ed899c6ac98203a459289 (diff)
downloadrails-3014f0f4c53da5b10294670976080b0036c016dd.tar.gz
rails-3014f0f4c53da5b10294670976080b0036c016dd.tar.bz2
rails-3014f0f4c53da5b10294670976080b0036c016dd.zip
Capitalized Rails where appropriate.
Diffstat (limited to 'railties/guides/source/security.textile')
-rw-r--r--railties/guides/source/security.textile2
1 files changed, 1 insertions, 1 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 875c4ae6e5..c26bea5519 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -392,7 +392,7 @@ params[:user] #=> {:name => “ow3ned”, :admin => true}
So if you create a new user using mass-assignment, it may be too easy to become an administrator.
-Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in rails 2.3. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
+Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
<ruby>
class Person < ActiveRecord::Base