From 3f9baeb2ec08138a0da09870ae60fd6b8165c07f Mon Sep 17 00:00:00 2001 From: David Czarnecki Date: Tue, 26 Feb 2013 10:49:47 -0500 Subject: Use less hyperbole in the language re: allowed parameters --- .../rails/generators/rails/scaffold_controller/templates/controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/railties/lib/rails/generators/rails/scaffold_controller/templates/controller.rb b/railties/lib/rails/generators/rails/scaffold_controller/templates/controller.rb index 72281a2fef..73e89086a5 100644 --- a/railties/lib/rails/generators/rails/scaffold_controller/templates/controller.rb +++ b/railties/lib/rails/generators/rails/scaffold_controller/templates/controller.rb @@ -56,7 +56,7 @@ class <%= controller_class_name %>Controller < ApplicationController @<%= singular_table_name %> = <%= orm_class.find(class_name, "params[:id]") %> end - # Never trust parameters from the scary internet, only allow the white list through. + # Only allow a trusted parameter "white list" through. def <%= "#{singular_table_name}_params" %> <%- if attributes_names.empty? -%> params[<%= ":#{singular_table_name}" %>] -- cgit v1.2.3