4 ms·
ActiveRecord 3.1 - Mass-Assignment Roles
- oomkiller 15y agoWrite up a patch? It may be a little late in the game to be changing APIs, but it might be ok since it's just beta 1.
- mark_l_watson 15y agoThis month's Communications of the ACM has a good article by Patrick McKenzie on Rails security, and the mass assignment vulnerability in particular.
- roryokane 15y agolink to that article: http://m.cacm.acm.org/magazines/2011/5/107701-weapons-of-mass-assignment/fulltext http://m.cacm.acm.org/magazines/2011/5/107701-weapons-of-mas...
- tomhallett 15y agoChaining the role would make it easier to add the role to inherited_resources, you'd just need to add it to your beginning_of_association_chain