Re: Mass Assignment Vulnerability -- Another Suggestion

Assaf Arkin
2009-03-02T06:12:13Z

On Sun, Mar 1, 2009 at 9:55 PM, Michael Koziarski
<michael@koziarski.com>wrote:

>
> > With 2.3 being so close, I''d think we''d want to
consider a change like
> > this for 3.0.  What do you guys think?
>
> Definitely not keen on this for 2.3, but for 3.0 it''s definitely
an
> option.  My main concern with adding attr_accessible to every model is
> that it''ll just be seen as noise by most developers,
who''ll simply
> either remove the line, or not bother understanding why it''s
there.
> Defaulting to ''everything inaccessible'' would be far too
strong and
> would just lead users to paste in some ''enable
everything'' snippet
> they found on the internet.
>
> My gut feeling on this is that education is really the only option,
> and perhaps we need to emphasise these settings in an introductory
> tutorial, but I''m open to other ideas.


I would welcome a change that will force me to use attr_accessible in all my
models. I know why I need to use it, so I''m past the educational phase,
I
just don''t always remember to use it, and if Rails could jog my memory,
that
would be great.

If there was an option in config, I would turn it on in every new project,
or use a template that defaults to on.


If other people choose to turn if off, that''s obviously their choice or
maybe they''re not interested to understand why the option is there. But
some
people would take that opportunity, they''ll pause to ask "why am I
fiddling
with this?" and that would be a chance to reach to them and explain.

Assaf


>
>
>
> --
> Cheers
>
> Koz
>
> >