On 06/25/2012 11:18 AM, Matt Wagner wrote:
On Thu, Jun 21, 2012 at 04:51:48PM -0400, Mo Morsi wrote:
> Redmine #3288, #3404, #3405
>
> This is the lastest revision to the latest round of security updates,
> incorporating all feedback so far. The spec and feature suites still work
> after these patches are applied and everything should be good to go for
> approval
ACK. This resend fixes the various issues with failing tests, and looks
sane. Plus, yay for better security.
Thanks for the ACK Matt, pushed the patches, closing out the security
story for this sprint.
Did we ever do anything thorough about protecting against
mass-assignment?
We are tackling the mass-assignment issue incrementally as we go through
the model classes. For example Maros pushed this [1] with some other
security fixes a little while ago adding the attribute protection to the
credential table. The plan of attack is to continue to do this,
analysing and updating each model class in the same manner as we are
doing w/ the controllers.
Will be reorganizing and updating the security page on the wiki soon and
sending a status report to the list w/ an overall assessment. Look for
that in the near future.
-Mo
[1]
https://github.com/aeolusproject/conductor/commit/274fb0b55fed6a6b9e597e8...