2 ms·
It wasn't really intended as a security example, more another example of unintended things happening if you don't know all the rules.
by bensummers 17y ago
It wasn't really intended as a security example, more another example of unintended things happening if you don't know all the rules.
- donw 17y agoThe rules in this case seem pretty standard to me; public/private methods work the same in controllers as they do in every other object. Rails is just using an existing mechanism that's been around in OO languages for a very, very long time, rather than implementing something else that does the exact same thing.
- bensummers 17y agoIt is reusing a standard OO mechanism, just not as well as it could. If all the Rails security tutorials feel they have to mention this point, then it's an indication that the design isn't quite right.
- tptacek 17y agoIf you don't understand the difference between "public" and "private" methods, no amount of object orientation is going to help you. Note also that Rails isn't even close to the first environment to use public scope to export methods.