diff options
4 files changed, 52 insertions, 4 deletions
diff --git a/activerecord/lib/active_record/relation/finder_methods.rb b/activerecord/lib/active_record/relation/finder_methods.rb index 475e4338ca..4659563f33 100644 --- a/activerecord/lib/active_record/relation/finder_methods.rb +++ b/activerecord/lib/active_record/relation/finder_methods.rb @@ -264,6 +264,7 @@ module ActiveRecord end def find_or_instantiator_by_attributes(match, attributes, *args) + options = args.size > 1 && args.last(2).all?{ |a| a.is_a?(Hash) } ? args.extract_options! : {} protected_attributes_for_create, unprotected_attributes_for_create = {}, {} args.each_with_index do |arg, i| if arg.is_a?(Hash) @@ -278,8 +279,7 @@ module ActiveRecord record = where(conditions).first unless record - record = @klass.new do |r| - r.assign_attributes(protected_attributes_for_create) + record = @klass.new(protected_attributes_for_create, options) do |r| r.assign_attributes(unprotected_attributes_for_create, :without_protection => true) end yield(record) if block_given? diff --git a/activerecord/test/cases/mass_assignment_security_test.rb b/activerecord/test/cases/mass_assignment_security_test.rb index 765033852d..33737e12a8 100644 --- a/activerecord/test/cases/mass_assignment_security_test.rb +++ b/activerecord/test/cases/mass_assignment_security_test.rb @@ -239,6 +239,54 @@ class MassAssignmentSecurityTest < ActiveRecord::TestCase end end + def test_find_or_initialize_by_with_attr_accessible_attributes + p = TightPerson.find_or_initialize_by_first_name('Josh', attributes_hash) + + assert_default_attributes(p) + end + + def test_find_or_initialize_by_with_admin_role_with_attr_accessible_attributes + p = TightPerson.find_or_initialize_by_first_name('Josh', attributes_hash, :as => :admin) + + assert_admin_attributes(p) + end + + def test_find_or_initialize_by_with_attr_protected_attributes + p = LoosePerson.find_or_initialize_by_first_name('Josh', attributes_hash) + + assert_default_attributes(p) + end + + def test_find_or_initialize_by_with_admin_role_with_attr_protected_attributes + p = LoosePerson.find_or_initialize_by_first_name('Josh', attributes_hash, :as => :admin) + + assert_admin_attributes(p) + end + + def test_find_or_create_by_with_attr_accessible_attributes + p = TightPerson.find_or_create_by_first_name('Josh', attributes_hash) + + assert_default_attributes(p, true) + end + + def test_find_or_create_by_with_admin_role_with_attr_accessible_attributes + p = TightPerson.find_or_create_by_first_name('Josh', attributes_hash, :as => :admin) + + assert_admin_attributes(p, true) + end + + def test_find_or_create_by_with_attr_protected_attributes + p = LoosePerson.find_or_create_by_first_name('Josh', attributes_hash) + + assert_default_attributes(p, true) + end + + def test_find_or_create_by_with_admin_role_with_attr_protected_attributes + p = LoosePerson.find_or_create_by_first_name('Josh', attributes_hash, :as => :admin) + + assert_admin_attributes(p, true) + end + end diff --git a/railties/lib/rails/generators/rails/app/templates/Gemfile b/railties/lib/rails/generators/rails/app/templates/Gemfile index 20bd9db624..5e1b4b0098 100644 --- a/railties/lib/rails/generators/rails/app/templates/Gemfile +++ b/railties/lib/rails/generators/rails/app/templates/Gemfile @@ -9,7 +9,7 @@ source 'http://rubygems.org' <%= "gem 'json'\n" if RUBY_VERSION < "1.9.2" -%> gem 'sass' gem 'coffee-script' -# gem 'uglifier' +gem 'uglifier' <%= gem_for_javascript %> diff --git a/railties/railties.gemspec b/railties/railties.gemspec index f1c92bd5d4..947f49be46 100644 --- a/railties/railties.gemspec +++ b/railties/railties.gemspec @@ -17,7 +17,7 @@ Gem::Specification.new do |s| s.rdoc_options << '--exclude' << '.' - s.add_dependency('rake', '>= 0.8.7') + s.add_dependency('rake', '= 0.8.7') s.add_dependency('thor', '~> 0.14.6') s.add_dependency('rack-ssl', '~> 1.3.2') s.add_dependency('activesupport', version) |