[PATCH conductor] redmine #3601: whitelist all attributes as needing to be explicitly set by default

Maros Zatko mzatko at redhat.com
Wed Oct 10 17:29:18 UTC 2012


please ignore this patch

On 10/10/2012 07:23 PM, mzatko at redhat.com wrote:
> From: Mo Morsi <mmorsi at redhat.com>
>
>    Note this patch requires rails 3.2 to work (which will be in Fedora soon [1])
>
>    This changes the application so that no mass assigments are permitted by default.
>
>    I added the neccessary model changes so that things should be working again with the
>    current mass assignments in place in the application (specs pass after this patch)
>
>    Obviously this still doesn't solve the mass assignment issue, but the items that should
>    be removed and explicitly set are marked with comments and thus we can tackle them one
>    by one in the various areas that they need to be set explicitly in the application
>
> [1] http://lists.fedoraproject.org/pipermail/ruby-sig/2012-July/001077.html
> ---
>   src/app/models/session_entity.rb | 3 +++
>   src/app/models/user.rb           | 2 ++
>   src/app/models/view_state.rb     | 2 ++
>   3 files changed, 7 insertions(+)
>
> diff --git a/src/app/models/session_entity.rb b/src/app/models/session_entity.rb
> index 98ac974..9a2d23a 100644
> --- a/src/app/models/session_entity.rb
> +++ b/src/app/models/session_entity.rb
> @@ -19,6 +19,9 @@ class SessionEntity < ActiveRecord::Base
>     belongs_to :entity
>     belongs_to :permission_session
>   
> +  attr_accessible :user, :session, :entity,
> +                  :user_id, :session_id, :entity_id
> +
>     validates_presence_of :user_id
>     validates_presence_of :permission_session_id
>     validates_presence_of :entity_id
> diff --git a/src/app/models/user.rb b/src/app/models/user.rb
> index 5db8e95..937abd1 100644
> --- a/src/app/models/user.rb
> +++ b/src/app/models/user.rb
> @@ -77,6 +77,8 @@ class User < ActiveRecord::Base
>     before_validation :strip_whitespace
>     after_save :update_entity
>   
> +  attr_accessible :login, :password, :password_confirmation, :first_name, :last_name, :quota, :email, :ignore_password
> +
>     validate :validate_ldap_changes, :if => Proc.new {|user|
>       !user.new_record? && SETTINGS_CONFIG[:auth][:strategy] == "ldap"}
>     validates_presence_of :quota
> diff --git a/src/app/models/view_state.rb b/src/app/models/view_state.rb
> index bc1f0fe..bfa2171 100644
> --- a/src/app/models/view_state.rb
> +++ b/src/app/models/view_state.rb
> @@ -33,6 +33,8 @@ class ViewState < ActiveRecord::Base
>     self.primary_key = :uuid
>     belongs_to :user
>   
> +  attr_accessible :name, :controller, :action, :station, :association
> +
>     validates_presence_of :name
>     validates_uniqueness_of :name
>     validates_presence_of :user_id




More information about the aeolus-devel mailing list