From 948b931925febac3c965ab13470065ced68f7b53 Mon Sep 17 00:00:00 2001 From: Sean Griffin Date: Mon, 26 Feb 2018 11:16:10 -0700 Subject: Never attempt to write virtual attributes to the database Currently the place where we limit what gets sent to the database is in the implementation for `partial_writes`. We should also be restricting it to column names when partial writes are turned off. Note that we're using `&` instead of just defaulting to `self.class.column_names`, as the instance version of `attribute_names` does not include attributes which are uninitialized (were not included in the select clause) --- activerecord/lib/active_record/persistence.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'activerecord/lib/active_record/persistence.rb') diff --git a/activerecord/lib/active_record/persistence.rb b/activerecord/lib/active_record/persistence.rb index 88b971327b..0b1000fcf9 100644 --- a/activerecord/lib/active_record/persistence.rb +++ b/activerecord/lib/active_record/persistence.rb @@ -703,7 +703,8 @@ module ActiveRecord # Updates the associated record with values matching those of the instance attributes. # Returns the number of affected rows. - def _update_record(attribute_names = self.attribute_names) + def _update_record(attribute_names = self.column_names) + attribute_names &= self.class.column_names attributes_values = arel_attributes_with_values_for_update(attribute_names) if attributes_values.empty? rows_affected = 0 @@ -721,6 +722,7 @@ module ActiveRecord # Creates a record with values matching those of the instance attributes # and returns its id. def _create_record(attribute_names = self.attribute_names) + attribute_names &= self.class.column_names attributes_values = arel_attributes_with_values_for_create(attribute_names) new_id = self.class._insert_record(attributes_values) -- cgit v1.2.3