4 ms·
def create @user = User.new(params[:user]) @title = "Sign up" render 'new' end So the end user can mess around with the form, add is_admin=1 to t
by gamache 17y ago
def create
@user = User.new(params[:user])
@title = "Sign up"
render 'new'
end
So the end user can mess around with the form, add is_admin=1 to the other CGI params and end up with an admin account. (Or similar.) Fabulous.
- tkiley 17y agoNo. Read this: http://www.railstutorial.org/chapters/modeling-and-viewing-users-one#sec:accessible_attributes http://www.railstutorial.org/chapters/modeling-and-viewing-u...
- ryanhuff 17y agoI don't see a problem with distilling an example to the basics when teaching beginners. Your concern should certainly be addressed at some point in the book though.
- mhartl 17y agoIndeed. See my other comment. :-)
- dzlobin 17y agoProlly should have read the rest of the book first, as shown in the link before, this isn't an issue
- mhartl 17y agoYou raise an important issue, which I've written about before (http://blog.mhartl.com/2008/09/21/mass-assignment-in-rails-applications/ http://blog.mhartl.com/2008/09/21/mass-assignment-in-rails-a... and http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications/ http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-as...) and emphasize in the Ruby on Rails Tutorial book. Happily, in this case there is no cause for concern. (1) The book uses test-driven development for the most part; the snippet you pasted is just enough to get the "failed signup" test to pass, and is not the full implementation. (2) The code you copied doesn't even save the user, so there's no potential security breach at this point. (3) There's no admin attribute yet. (It's coming in Chapter 9.) (4) The User model is protected by attr_accessible in any case, as discussed in Chapter 5 (http://www.railstutorial.org/chapters/modeling-and-viewing-users-one#sec:accessible_attributes http://www.railstutorial.org/chapters/modeling-and-viewing-u...). There's no way to tell from inspecting a controller action whether or not there's a security breach at the model level. N.B. Just yesterday I exchanged notes with Yehuda Katz on this very subject; he and Carl Lerche both agree that Rails should close the attr_accessible security hole by default, much as Rails 3 now escapes the output of Embedded Ruby by default. My hope is that we'll see this implemented in Rails 3.x, for some value of x.
- maurycy 17y agoattr_accessible, messieur