aboutsummaryrefslogtreecommitdiffstats
path: root/railties
diff options
context:
space:
mode:
authordaniely <daniel.kiros@gmail.com>2012-02-01 23:14:28 +0800
committerdaniely <daniel.kiros@gmail.com>2012-02-01 23:14:28 +0800
commitc6d880f48d133ff287677a67e8fb881b8bcbfaf3 (patch)
tree0654b7ba430a48fa4d3810a80476c35d1221bab3 /railties
parent31fce0192ee83ee13e2b17fdeefa712227019e49 (diff)
downloadrails-c6d880f48d133ff287677a67e8fb881b8bcbfaf3.tar.gz
rails-c6d880f48d133ff287677a67e8fb881b8bcbfaf3.tar.bz2
rails-c6d880f48d133ff287677a67e8fb881b8bcbfaf3.zip
escape plus sign in "Rails 2.3+" to fix markup
Diffstat (limited to 'railties')
-rw-r--r--railties/guides/source/security.textile2
1 files changed, 1 insertions, 1 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index c2ef7bf9b5..360af6c986 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -385,7 +385,7 @@ params[:user] # => {:name => “ow3ned”, :admin => true}
So if you create a new user using mass-assignment, it may be too easy to become an administrator.
-Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3+. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
+Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the <tt>attributes=</tt> method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3==+==. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example:
<ruby>
class Person < ActiveRecord::Base