5 ms·
I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somew
by enoch_r 14y ago
I was slightly sympathetic to them right up until smeagle posted RKearney's email. While not noticing an incredibly obvious security hole is serious, it's somewhat understandable in the context of a site that unintentionally goes public before it's ready. What's far, far worse is the mindset in which someone who points out a security hole is the problem, and should be personally attacked.
They should have thanked him, notified their users, done a thorough review of their own security, and warned new signups to only use IAM keys. Instead they got defensive, made excuses, and attacked the messenger.
- oelmekki 14y ago> it's somewhat understandable in the context of a site that unintentionally goes public before it's ready Sorry, but no. There is absolutely no good reason while creating an user controller - even when writing the very first lines - to not check against current user on sensible actions. Actually, I may argue that's the very first thing you do once the controller skeleton is set up.
- alinajaf 14y agoAgreed. You don't even need to add any gems or do any rails magic for this to work. In your controller: def edit @aws_credentials = current_user.aws_credentials end def update current_user.aws_credentials.update_attributes( params[:aws_credentials].slice(:a, :b, :c) ) end
- bhousel 14y agoDon't forget `destroy`.