4 ms·
Meh. I don't use attr_protected anyway, and neither should anyone else. Security 101 - whitelist, don't blacklist. That said the JSON issue looks worrying, so
by venus 14y ago
Meh. I don't use attr_protected anyway, and neither should anyone else. Security 101 - whitelist, don't blacklist.
That said the JSON issue looks worrying, so an update and redeploy is necessary.
- lucisferre 14y agoI've already switched to using the strong_parameters gem. I'd recommend it to anyone else starting a new rails 3 project.
- venus 14y ago+1 to this. For new projects I'd probably just go with 4.0 beta though, it's almost ready...
- lucisferre 14y agoI can't completely agree with that. I spent some time with 4.0 with the intention of building on it but found too many broken Gems to be productive with it. If you don't intend to use many (or any) third-party Gems it's less of a problem.