[PATCH aeolus-conductor] BZ#786126 Do not mass assign on credentials hash

Jan Provaznik jprovazn at redhat.com
Wed Feb 1 08:44:06 UTC 2012


On 01/31/2012 03:41 PM, mtaylor at redhat.com wrote:
> From: Martyn Taylor<mtaylor at redhat.com>
>
> ---
>   .../controllers/provider_accounts_controller.rb    |    1 +
>   src/app/models/provider_account.rb                 |    5 +++++
>   2 files changed, 6 insertions(+), 0 deletions(-)
>
> diff --git a/src/app/controllers/provider_accounts_controller.rb b/src/app/controllers/provider_accounts_controller.rb
> index 9b5517d..b78ee52 100644
> --- a/src/app/controllers/provider_accounts_controller.rb
> +++ b/src/app/controllers/provider_accounts_controller.rb
> @@ -79,6 +79,7 @@ class ProviderAccountsController<  ApplicationController
>       params[:provider_account][:provider_id] = @provider.id
>       @providers = Provider.all
>       @provider_account = ProviderAccount.new(params[:provider_account])
> +    @provider_account.credentials_hash = params[:provider_account][:credentials_hash]
>       @provider_account.quota = @quota = Quota.new
>       limit = params[:quota][:maximum_running_instances] if params[:quota]
>       @provider_account.quota.set_maximum_running_instances(limit)
> diff --git a/src/app/models/provider_account.rb b/src/app/models/provider_account.rb
> index e772f52..ce4fb81 100644
> --- a/src/app/models/provider_account.rb
> +++ b/src/app/models/provider_account.rb
> @@ -74,6 +74,11 @@ class ProviderAccount<  ActiveRecord::Base
>
>     scope :enabled, lambda { where(:provider_id =>  Provider.enabled) }
>
> +  # We set credentials hash as protected so that it is not set during mass assign on new
> +  # This is to avoid the scenario where the credentials are set before provider which
> +  # will result in an exception.
> +  attr_protected :credentials_hash
> +
>     def validate_presence_of_credentials
>       provider.provider_type.credential_definitions.each do |cd|
>         errors.add(:base, "#{cd.label} can't be blank") if credentials_hash[cd.name].blank?

Hi Martyn,
explicit credentials_hash setting should be done also in update action 
(update_attributes is mass assignment too, I think).

Jan



More information about the aeolus-devel mailing list