4 ms·
It won't help. After @pk.update_attr(params[:pk]) you drop mailicious pub key to user params[:pk][:user_id] no way
by homakov 15y ago
It won't help.
After @pk.update_attr(params[:pk]) you drop mailicious pub key to user params[:pk][:user_id]
no way
- omgsean 15y agoAh that's right, in this case he's trying to make something that belongs to him belong to someone else. Regardless, something like user_id should be protected and really if you're setting up a website whose primary audience is made up of hackers you should be whitelisting on every model.