Could be a bug or even someone trying to inject malicious javascript
code into your app.
Either case its a good practice to have these kind of scenarios
covered by tests.
You should also make sure that some fields are protected from mass-assignment.
In your hash you have is_admin => 0. If you have in your controller:
User.create params[:user]
# or
@user.update_attributes params[:user]
Then anybody can create an admin user by posting is_admin=1, unless
you protect it in your model like this:
class User < ActiveRecord::Base
attr_protected :is_admin
# or
attr_accessible :name, :email, :username
end
Railscasts.com has some screencasts on this topic: http://railscasts.com/tags/5
--
gudleik
On Tue, Aug 10, 2010 at 9:04 PM, Hassan Schroeder
<hassan.schroe...@gmail.com> wrote:
> On Tue, Aug 10, 2010 at 10:21 AM, jemminger <jemmin...@gmail.com> wrote:
>
>> {"user"=>
>> {"email_confirmation"=>"some...@example.com",
>> "wants_new_message_notifications"=>"1",
>> "is_admin"=>"0",
>> "<script type"=>"=MyLastName",
>> "first_name"=>"MyFirstName",
>
>> I'm wondering what could be renaming the form field names on the
>> client side to cause this? I have verified that the rendered HTML is
>> correct.
>
> How? Using the W3C validator?
>
> I'd bet on a mis-matched/imbalanced quotes and/or tags somewhere
> close to that input field.
>
> Unless you have some JavaScript doing some funny innerHTML
> insertions; but easy enough to turn off JS and see if the error recurs.
>
> FWIW,
> --
> Hassan Schroeder ------------------------ hassan.schroe...@gmail.com
> twitter: @hassan
>
> --
> You received this message because you are subscribed to the Google Groups
> "Ruby on Rails: Talk" group.
> To post to this group, send email to rubyonrails-t...@googlegroups.com.
> To unsubscribe from this group, send email to
> rubyonrails-talk+unsubscr...@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/rubyonrails-talk?hl=en.
>
>
--
You received this message because you are subscribed to the Google Groups "Ruby
on Rails: Talk" group.
To post to this group, send email to rubyonrails-t...@googlegroups.com.
To unsubscribe from this group, send email to
rubyonrails-talk+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en.