Re: Mass Assignment Vulnerability -- Another Suggestion

Michael Koziarski
2009-03-02T05:55:33Z

> With 2.3 being so close, I''d think we''d want to consider
a change like
> this for 3.0.  What do you guys think?

Definitely not keen on this for 2.3, but for 3.0 it''s definitely an
option.  My main concern with adding attr_accessible to every model is
that it''ll just be seen as noise by most developers, who''ll
simply
either remove the line, or not bother understanding why it''s there.
Defaulting to ''everything inaccessible'' would be far too
strong and
would just lead users to paste in some ''enable everything''
snippet
they found on the internet.

My gut feeling on this is that education is really the only option,
and perhaps we need to emphasise these settings in an introductory
tutorial, but I''m open to other ideas.



--
Cheers

Koz