[PATCH aeolus-conductor] BZ#786126 Do not mass assign on credentials hash
Jan Provaznik
jprovazn at redhat.com
Wed Feb 1 08:44:06 UTC 2012
On 01/31/2012 03:41 PM, mtaylor at redhat.com wrote:
> From: Martyn Taylor<mtaylor at redhat.com>
>
> ---
> .../controllers/provider_accounts_controller.rb | 1 +
> src/app/models/provider_account.rb | 5 +++++
> 2 files changed, 6 insertions(+), 0 deletions(-)
>
> diff --git a/src/app/controllers/provider_accounts_controller.rb b/src/app/controllers/provider_accounts_controller.rb
> index 9b5517d..b78ee52 100644
> --- a/src/app/controllers/provider_accounts_controller.rb
> +++ b/src/app/controllers/provider_accounts_controller.rb
> @@ -79,6 +79,7 @@ class ProviderAccountsController< ApplicationController
> params[:provider_account][:provider_id] = @provider.id
> @providers = Provider.all
> @provider_account = ProviderAccount.new(params[:provider_account])
> + @provider_account.credentials_hash = params[:provider_account][:credentials_hash]
> @provider_account.quota = @quota = Quota.new
> limit = params[:quota][:maximum_running_instances] if params[:quota]
> @provider_account.quota.set_maximum_running_instances(limit)
> diff --git a/src/app/models/provider_account.rb b/src/app/models/provider_account.rb
> index e772f52..ce4fb81 100644
> --- a/src/app/models/provider_account.rb
> +++ b/src/app/models/provider_account.rb
> @@ -74,6 +74,11 @@ class ProviderAccount< ActiveRecord::Base
>
> scope :enabled, lambda { where(:provider_id => Provider.enabled) }
>
> + # We set credentials hash as protected so that it is not set during mass assign on new
> + # This is to avoid the scenario where the credentials are set before provider which
> + # will result in an exception.
> + attr_protected :credentials_hash
> +
> def validate_presence_of_credentials
> provider.provider_type.credential_definitions.each do |cd|
> errors.add(:base, "#{cd.label} can't be blank") if credentials_hash[cd.name].blank?
Hi Martyn,
explicit credentials_hash setting should be done also in update action
(update_attributes is mass assignment too, I think).
Jan
More information about the aeolus-devel
mailing list