From 9fa080e703362876b5afe9a7627bf3ffb6fa131e Mon Sep 17 00:00:00 2001 From: Sebastian Martinez Date: Mon, 2 May 2011 00:15:36 -0300 Subject: Update security guide with #new and #create respect mass-assignment --- railties/guides/source/security.textile | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'railties') diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index f87ffdb20d..40fe764ae9 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -441,7 +441,7 @@ params[:user] # => {:name => "ow3ned", :admin => true} @user.admin # => true -When assigning attributes in Active Record using +new+, +attributes=+, or +update_attributes+ the :default scope will be used. To assign attributes using different scopes you should use +assign_attributes+ which accepts an optional :as options parameter. If no :as option is provided then the :default scope will be used. You can also bypass mass-assignment security by using the +:without_protection+ option. Here is an example: +When assigning attributes in Active Record using +attributes=+, or +update_attributes+ the :default scope will be used. To assign attributes using different scopes you should use +assign_attributes+ which accepts an optional :as options parameter. If no :as option is provided then the :default scope will be used. You can also bypass mass-assignment security by using the +:without_protection+ option. Here is an example: @user = User.new @@ -459,7 +459,19 @@ When assigning attributes in Active Record using +new+, +attributes=+, or +updat @user.is_admin # => true -A more paranoid technique to protect your whole project would be to enforce that all models define their accessible attributes. This can be easily achieved with a very simple application config option of: +In a similar way, +new+, +create+ and create! methods respect mass-assignment security and accepts either +:as+ or +:without_protection+ options. For example: + + +@user = User.new({ :name => 'Sebastian', :is_admin => true }, :as => :admin) +@user.name # => Sebastian +@user.is_admin # => true + +@user = User.create({ :name => 'Sebastian', :is_admin => true }, :without_protection => true) +@user.name # => Sebastian +@user.is_admin # => true + + +A more paranoid technique to protect your whole project would be to enforce that all models define their accessible attributes. This can be easily achieved with a very simple application config option of: config.active_record.whitelist_attributes = true -- cgit v1.2.3