“Episode 26 - Hackers Love Mass Assignment”

Protect your Rails project from Hackers:

26: Hackers Love Mass Assignment (view original Railscast) Other translations: Other formats: Mass assignment is something most Rails programmers make use of as it provides an easy way to populate the properties of a model object from a form. Unfortunately its simplicity can make it a target for hackers. We’ll explain how and show you how to solve it in this episode. Our simple registration form. Above is a simple user registration form. When a user enters their user name and clicks “submit” a new User model is created. Our user model is defined in the schema like this, with a string field called name and a boolean field called admin that defaults to false. create_table :users do |t| t.string :name t.boolean :admin, :default => false, :null => false end When a user fills in the form and clicks register, the create action is called. def create @user = User.new(params[:user]...

Full article: http://asciicasts.com/episodes/26-hackers-love-mass-assig...