4 ms·
Is it really Rails specific? I seem to remember Struts working the same way and most other reflection based frameworks working the same way. The particular sol
by mattmcknight 17y ago
Is it really Rails specific? I seem to remember Struts working the same way and most other reflection based frameworks working the same way.
The particular solution outlined in the OP is quite incomplete. We need a check not see just which attributes can be edited by a user, but which rows can be edited by a user. attr_accessible offers no protection there.
- angelbob 17y agoIt's not Rails-specific that you need to protect your models with reasonable security logic. This particular flavor of "oops, not protected by default" is Rails-specific. And Rails is highlighting the fact that "allowed by default" is convenient, while the post highlights the fact that "allowed by default" is insecure :-)
- mattmcknight 17y ago"This particular flavor of "oops, not protected by default" is Rails-specific." Uhh...if it is in most other frameworks, as I claim, and you don't deny, then it is not Rails-specific.
- angelbob 17y agoWhen I say "this particular flavor of", I use that to distinguish between Rails and other frameworks. The protected attribute tags that Rails uses are not common to other frameworks.