diff options
Diffstat (limited to 'activemodel/lib')
| -rw-r--r-- | activemodel/lib/active_model/mass_assignment_security.rb | 46 | ||||
| -rw-r--r-- | activemodel/lib/active_model/observer_array.rb | 45 | ||||
| -rw-r--r-- | activemodel/lib/active_model/observing.rb | 9 |
3 files changed, 74 insertions, 26 deletions
diff --git a/activemodel/lib/active_model/mass_assignment_security.rb b/activemodel/lib/active_model/mass_assignment_security.rb index 01eef762fd..483b577681 100644 --- a/activemodel/lib/active_model/mass_assignment_security.rb +++ b/activemodel/lib/active_model/mass_assignment_security.rb @@ -35,17 +35,17 @@ module ActiveModel # protected # # def account_params - # scope = admin ? :admin : :default - # sanitize_for_mass_assignment(params[:account], scope) + # role = admin ? :admin : :default + # sanitize_for_mass_assignment(params[:account], role) # end # # end # module ClassMethods # Attributes named in this macro are protected from mass-assignment - # whenever attributes are sanitized before assignment. A scope for the - # attributes is optional, if no scope is provided then :default is used. - # A scope can be defined by using the :as option. + # whenever attributes are sanitized before assignment. A role for the + # attributes is optional, if no role is provided then :default is used. + # A role can be defined by using the :as option. # # Mass-assignment to these attributes will simply be ignored, to assign # to them you can use direct writer methods. This is meant to protect @@ -67,7 +67,7 @@ module ActiveModel # end # end # - # When using a :default scope : + # When using the :default role : # # customer = Customer.new # customer.assign_attributes({ "name" => "David", "credit_rating" => "Excellent", :last_login => 1.day.ago }, :as => :default) @@ -78,7 +78,7 @@ module ActiveModel # customer.credit_rating = "Average" # customer.credit_rating # => "Average" # - # And using the :admin scope : + # And using the :admin role : # # customer = Customer.new # customer.assign_attributes({ "name" => "David", "credit_rating" => "Excellent", :last_login => 1.day.ago }, :as => :admin) @@ -93,10 +93,10 @@ module ActiveModel # to sanitize attributes won't provide sufficient protection. def attr_protected(*args) options = args.extract_options! - scope = options[:as] || :default + role = options[:as] || :default self._protected_attributes = protected_attributes_configs.dup - self._protected_attributes[scope] = self.protected_attributes(scope) + args + self._protected_attributes[role] = self.protected_attributes(role) + args self._active_authorizer = self._protected_attributes end @@ -104,8 +104,8 @@ module ActiveModel # Specifies a white list of model attributes that can be set via # mass-assignment. # - # Like +attr_protected+, a scope for the attributes is optional, - # if no scope is provided then :default is used. A scope can be defined by + # Like +attr_protected+, a role for the attributes is optional, + # if no role is provided then :default is used. A role can be defined by # using the :as option. # # This is the opposite of the +attr_protected+ macro: Mass-assignment @@ -131,7 +131,7 @@ module ActiveModel # end # end # - # When using a :default scope : + # When using the :default role : # # customer = Customer.new # customer.assign_attributes({ "name" => "David", "credit_rating" => "Excellent", :last_login => 1.day.ago }, :as => :default) @@ -141,7 +141,7 @@ module ActiveModel # customer.credit_rating = "Average" # customer.credit_rating # => "Average" # - # And using the :admin scope : + # And using the :admin role : # # customer = Customer.new # customer.assign_attributes({ "name" => "David", "credit_rating" => "Excellent", :last_login => 1.day.ago }, :as => :admin) @@ -152,20 +152,20 @@ module ActiveModel # to sanitize attributes won't provide sufficient protection. def attr_accessible(*args) options = args.extract_options! - scope = options[:as] || :default + role = options[:as] || :default self._accessible_attributes = accessible_attributes_configs.dup - self._accessible_attributes[scope] = self.accessible_attributes(scope) + args + self._accessible_attributes[role] = self.accessible_attributes(role) + args self._active_authorizer = self._accessible_attributes end - def protected_attributes(scope = :default) - protected_attributes_configs[scope] + def protected_attributes(role = :default) + protected_attributes_configs[role] end - def accessible_attributes(scope = :default) - accessible_attributes_configs[scope] + def accessible_attributes(role = :default) + accessible_attributes_configs[role] end def active_authorizers @@ -198,12 +198,12 @@ module ActiveModel protected - def sanitize_for_mass_assignment(attributes, scope = :default) - mass_assignment_authorizer(scope).sanitize(attributes) + def sanitize_for_mass_assignment(attributes, role = :default) + mass_assignment_authorizer(role).sanitize(attributes) end - def mass_assignment_authorizer(scope = :default) - self.class.active_authorizer[scope] + def mass_assignment_authorizer(role = :default) + self.class.active_authorizer[role] end end end diff --git a/activemodel/lib/active_model/observer_array.rb b/activemodel/lib/active_model/observer_array.rb index ab7f86007f..5fb73f1c78 100644 --- a/activemodel/lib/active_model/observer_array.rb +++ b/activemodel/lib/active_model/observer_array.rb @@ -2,7 +2,7 @@ require 'set' module ActiveModel # Stores the enabled/disabled state of individual observers for - # a particular model classes. + # a particular model class. class ObserverArray < Array attr_reader :model_class def initialize(model_class, *args) @@ -10,14 +10,57 @@ module ActiveModel super(*args) end + # Returns true if the given observer is disabled for the model class. def disabled_for?(observer) disabled_observers.include?(observer.class) end + # Disables one or more observers. This supports multiple forms: + # + # ORM.observers.disable :user_observer + # # => disables the UserObserver + # + # User.observers.disable AuditTrail + # # => disables the AuditTrail observer for User notifications. + # # Other models will still notify the AuditTrail observer. + # + # ORM.observers.disable :observer_1, :observer_2 + # # => disables Observer1 and Observer2 for all models. + # + # ORM.observers.disable :all + # # => disables all observers for all models. + # + # User.observers.disable :all do + # # all user observers are disabled for + # # just the duration of the block + # end def disable(*observers, &block) set_enablement(false, observers, &block) end + # Enables one or more observers. This supports multiple forms: + # + # ORM.observers.enable :user_observer + # # => enables the UserObserver + # + # User.observers.enable AuditTrail + # # => enables the AuditTrail observer for User notifications. + # # Other models will not be affected (i.e. they will not + # # trigger notifications to AuditTrail if previously disabled) + # + # ORM.observers.enable :observer_1, :observer_2 + # # => enables Observer1 and Observer2 for all models. + # + # ORM.observers.enable :all + # # => enables all observers for all models. + # + # User.observers.enable :all do + # # all user observers are enabled for + # # just the duration of the block + # end + # + # Note: all observers are enabled by default. This method is only + # useful when you have previously disabled one or more observers. def enable(*observers, &block) set_enablement(true, observers, &block) end diff --git a/activemodel/lib/active_model/observing.rb b/activemodel/lib/active_model/observing.rb index cfe71074a5..4682ae07ef 100644 --- a/activemodel/lib/active_model/observing.rb +++ b/activemodel/lib/active_model/observing.rb @@ -40,7 +40,11 @@ module ActiveModel observers.replace(values.flatten) end - # Gets the current observers. + # Gets an array of observers observing this model. + # The array also provides +enable+ and +disable+ methods + # that allow you to selectively enable and disable observers. + # (see <tt>ActiveModel::ObserverArray.enable</tt> and + # <tt>ActiveModel::ObserverArray.disable</tt> for more on this) def observers @observers ||= ObserverArray.new(self) end @@ -222,7 +226,8 @@ module ActiveModel self.class.observed_classes end - # Send observed_method(object) if the method exists. + # Send observed_method(object) if the method exists and + # the observer is enabled for the given object's class. def update(observed_method, object) #:nodoc: return unless respond_to?(observed_method) return if disabled_for?(object) |