thr3ads.net - Rails - habtm with created_on attr not being set [Aug 2006]

If this information is useful, please help other people find it:
Share via:

Andy Koch

2006-Aug-27 21:51 UTC

habtm with created_on attr not being set

Greetings Railers,

I have a many-many defined as habtm from both sides of the equation. 
I''ve also set the join table with appropriate belongs_to defines.

I followed this example to make it work,

jrhicks.net/Projects/rails/has_many_and_belongs_to_many.pdf

which does work, for maintaining the many-many relationship records.

the relevant line is

@A.Bs = B.find(@params[:A_ids]) if @params[:A_ids]

but the problem is that in my many-many table I have a "created_on" 
field, as I''d like to track when this relationship is created.

Unfortunately this field is not getting auto-magically filled.

So, I''m wondering if this is due to the many-many type relationship not
allowing (or supporting) this type of thing.  Or is it the technique
I''m
using to maintain the relationship?

Or perhaps there is something completely different I''m not aware of, 
entirely possible as I''ve been doing Rails work for all of 2 weeks now.


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Daniel Jilg

2006-Aug-27 22:08 UTC

head link

Re: habtm with created_on attr not being set

Hi,
> Unfortunately this field is not getting auto-magically filled.
> 
> So, I''m wondering if this is due to the many-many type
relationship not
> allowing (or supporting) this type of thing.  Or is it the technique
I''m
> using to maintain the relationship?
I had a similar problem a few weeks ago. With a simple 
has_and_belongs_to_many, you can''t do what you want in Rails.
> Or perhaps there is something completely different I''m not aware
of,
> entirely possible as I''ve been doing Rails work for all of 2 weeks
now.
There is indeed something different, two things in fact. The first is 
called push_with_attributes, and I never got quite behind how it works. 
It''s also deprecated by now, so you really shouldn''t use it.
The second
is the quite elegant has_many :through association.

Have a look at this article: 
http://blog.hasmanythrough.com/articles/2006/04/20/many-to-many-dance-off

Which should give you good pointers, just as it did with me.

HTH,
Daniel

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Tamim Azizadah

2006-Aug-27 22:27 UTC

head link

Security question

I know that doing something like this leaves you totally open to SQL 
injection attacks:

contacts = Contact.find(:all, :conditions => "name = 
#{params[:name]")

and should be written this way instead:

contacts = Contact.find(:all, :conditions => ["name = ?",
params[:name]])

but is this safe?:

contact = Contact.find(params[:id])

or should that be written as?:

contact = Contact.find(:first, :conditions => ["id = ?",
params[:id]])

Thanks.

Best Regards,

Tamim



--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Daniel Jilg

2006-Aug-27 22:43 UTC

head link

Re: Security question

How about Contact.find((params[:id]).to_i) ? Cant inject much with only 
numbers....

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Tamim Azizadah

2006-Aug-27 22:58 UTC

head link

Re: Security question

That''s an excellent idea as well! I guess I was just curious whether
the
find by id was safe to start with. I don''t want to add extra code if
not
needed. Going for the minimalist approach :)

Best Regards,

Tamim
ruby n00bie

Daniel Jilg wrote:> How about Contact.find((params[:id]).to_i) ? Cant inject much with only 
> numbers....
>
>   

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Jeremy Kemper

2006-Aug-27 23:04 UTC

head link

Re: Security question

On 8/27/06, Tamim Azizadah <taz-TOmwmVgPDaxWk0Htik3J/w@public.gmane.org>
wrote:>
> I know that doing something like this leaves you totally open to SQL
> injection attacks:
>
> contacts = Contact.find(:all, :conditions => "name = 
#{params[:name]")
>
> and should be written this way instead:
>
> contacts = Contact.find(:all, :conditions => ["name = ?",
params[:name]])
>
> but is this safe?:
>
> contact = Contact.find(params[:id])
>
> or should that be written as?:
>
> contact = Contact.find(:first, :conditions => ["id = ?",
params[:id]])

Contact.find(params[:id]) sanitizes its input as you expect.

jeremy


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Jeremy Kemper

2006-Aug-27 23:17 UTC

head link

Re: Security question

On 8/27/06, Tamim Azizadah <taz-TOmwmVgPDaxWk0Htik3J/w@public.gmane.org>
wrote:>
> That''s an excellent idea as well! I guess I was just curious
whether the
> find by id was safe to start with. I don''t want to add extra code
if not
> needed. Going for the minimalist approach :)
>
> Best Regards,
>
> Tamim
> ruby n00bie
>
> Daniel Jilg wrote:
> > How about Contact.find((params[:id]).to_i) ? Cant inject much with
only
> > numbers....

However, ''abc''.to_i == 0.

jeremy


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Tamim Azizadah

2006-Aug-27 23:40 UTC

head link

Re: Security question

Thanks for the clarification. That makes life much easier.

Best Regards,

Tamim
ruby n00bie

Jeremy Kemper wrote:> On 8/27/06, *Tamim Azizadah*
<taz-TOmwmVgPDaxWk0Htik3J/w@public.gmane.org
> <mailto:taz-TOmwmVgPDaxWk0Htik3J/w@public.gmane.org>> wrote:
>
>     I know that doing something like this leaves you totally open to SQL
>     injection attacks:
>
>     contacts = Contact.find(:all, :conditions => "name
>     =  #{params[:name]")
>
>     and should be written this way instead:
>
>     contacts = Contact.find(:all, :conditions => ["name = ?",
>     params[:name]])
>
>     but is this safe?:
>
>     contact = Contact.find(params[:id])
>
>     or should that be written as?:
>
>     contact = Contact.find (:first, :conditions => ["id = ?",
>     params[:id]])
>
>
> Contact.find(params[:id]) sanitizes its input as you expect.
>
> jeremy
>
> >

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Daniel Jilg

2006-Aug-28 15:06 UTC

head link

Re: Security question

Jeremy,

thanks for the clarification that Model.find(id) sanitizes id, I didn''t
know that as well!
> However, ''abc''.to_i == 0
Isn''t that the point? everything that isnt a number just gets replaced 
by 0. The only thing you can do then as an attacker is to fetch 
non-existant rows, which doesnt hurt the application too much.

Of course, this approach is not needed at all, with Model.find 
sanitizing the id anyways...

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Jeremy Kemper

2006-Aug-28 16:09 UTC

head link

Re: Security question

On 8/28/06, Daniel Jilg
<rails-mailing-list-ARtvInVfO7ksV2N9l4h3zg@public.gmane.org>
wrote:>
>
> Jeremy,
>
> thanks for the clarification that Model.find(id) sanitizes id, I
didn''t
> know that as well!
>
> > However, ''abc''.to_i == 0
>
> Isn''t that the point? everything that isnt a number just gets
replaced
> by 0. The only thing you can do then as an attacker is to fetch
> non-existant rows, which doesnt hurt the application too much.

Because a record with id 0 may exist, whereas a record with id
''abc'' cannot.

jeremy


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---

Rails - Aug 2006 - habtm with created_on attr not being set

habtm with created_on attr not being set

Re: habtm with created_on attr not being set

Security question

Re: Security question

Re: Security question

Re: Security question

Re: Security question

Re: Security question

Re: Security question

Re: Security question