From: Mo Morsi <[email protected]> Note this patch requires rails 3.2 to work (which will be in Fedora soon [1])
This changes the application so that no mass assigments are permitted by default. I added the neccessary model changes so that things should be working again with the current mass assignments in place in the application (specs pass after this patch) Obviously this still doesn't solve the mass assignment issue, but the items that should be removed and explicitly set are marked with comments and thus we can tackle them one by one in the various areas that they need to be set explicitly in the application [1] http://lists.fedoraproject.org/pipermail/ruby-sig/2012-July/001077.html --- src/app/models/session_entity.rb | 3 +++ src/app/models/user.rb | 2 ++ src/app/models/view_state.rb | 2 ++ 3 files changed, 7 insertions(+) diff --git a/src/app/models/session_entity.rb b/src/app/models/session_entity.rb index 98ac974..9a2d23a 100644 --- a/src/app/models/session_entity.rb +++ b/src/app/models/session_entity.rb @@ -19,6 +19,9 @@ class SessionEntity < ActiveRecord::Base belongs_to :entity belongs_to :permission_session + attr_accessible :user, :session, :entity, + :user_id, :session_id, :entity_id + validates_presence_of :user_id validates_presence_of :permission_session_id validates_presence_of :entity_id diff --git a/src/app/models/user.rb b/src/app/models/user.rb index 5db8e95..937abd1 100644 --- a/src/app/models/user.rb +++ b/src/app/models/user.rb @@ -77,6 +77,8 @@ class User < ActiveRecord::Base before_validation :strip_whitespace after_save :update_entity + attr_accessible :login, :password, :password_confirmation, :first_name, :last_name, :quota, :email, :ignore_password + validate :validate_ldap_changes, :if => Proc.new {|user| !user.new_record? && SETTINGS_CONFIG[:auth][:strategy] == "ldap"} validates_presence_of :quota diff --git a/src/app/models/view_state.rb b/src/app/models/view_state.rb index bc1f0fe..bfa2171 100644 --- a/src/app/models/view_state.rb +++ b/src/app/models/view_state.rb @@ -33,6 +33,8 @@ class ViewState < ActiveRecord::Base self.primary_key = :uuid belongs_to :user + attr_accessible :name, :controller, :action, :station, :association + validates_presence_of :name validates_uniqueness_of :name validates_presence_of :user_id -- 1.7.11.4
