[PATCH conductor] rm3343: credential: make attributes accessible/protected

Maros Zatko mzatko at redhat.com
Mon Jun 4 10:21:35 UTC 2012


On 06/01/2012 09:23 PM, Matt Wagner wrote:
> On Fri, Jun 01, 2012 at 04:54:43PM +0200, mzatko at redhat.com wrote:
>> From: Maros Zatko<mzatko at redhat.com>
>>
>> ---
>>   src/app/models/credential.rb |    3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/src/app/models/credential.rb b/src/app/models/credential.rb
>> index 4b06a36..a52319c 100644
>> --- a/src/app/models/credential.rb
>> +++ b/src/app/models/credential.rb
>> @@ -34,4 +34,7 @@ class Credential<  ActiveRecord::Base
>>     validates_presence_of :credential_definition_id
>>     validates_presence_of :value
>>     validates_uniqueness_of :credential_definition_id, :scope =>  :provider_account_id
>> +
>> +  attr_protected :id, :provider_account_id, :created_at
>> +  attr_accessible :value, :credential_definition_id
> This is not a review, but I'm just curious -- how are we deciding what
> attributes get protected? It's not quite intuitive to me why we're
> protected :created_at (but not :updated_at), but allowing
> :credential_definition_id to be mass-assigned. If I were an attacker it
> seems like there might be an advantage to seeing if I could remap
> credential_definition_id to point to something else, much moreso than
> making it look like a credential was created at a different time than it
> really was.
>
> Again, this isn't a patch review; I'm just curious if there's some
> additional logic I'm missing here.
>
> -- Matt
>
>>   end
>> -- 
>> 1.7.10.2
Actually, this interests me as well since it has been done by Mo, so 
it's question for him.
Mo, could you please clarify?
Thanks
-maros



More information about the aeolus-devel mailing list