[PATCH conductor] rm3343: credential: make attributes accessible/protected

Matt Wagner matt.wagner at redhat.com
Fri Jun 1 19:23:28 UTC 2012


On Fri, Jun 01, 2012 at 04:54:43PM +0200, mzatko at redhat.com wrote:
> From: Maros Zatko <mzatko at redhat.com>
> 
> ---
>  src/app/models/credential.rb |    3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/src/app/models/credential.rb b/src/app/models/credential.rb
> index 4b06a36..a52319c 100644
> --- a/src/app/models/credential.rb
> +++ b/src/app/models/credential.rb
> @@ -34,4 +34,7 @@ class Credential < ActiveRecord::Base
>    validates_presence_of :credential_definition_id
>    validates_presence_of :value
>    validates_uniqueness_of :credential_definition_id, :scope => :provider_account_id
> +
> +  attr_protected :id, :provider_account_id, :created_at
> +  attr_accessible :value, :credential_definition_id

This is not a review, but I'm just curious -- how are we deciding what
attributes get protected? It's not quite intuitive to me why we're
protected :created_at (but not :updated_at), but allowing
:credential_definition_id to be mass-assigned. If I were an attacker it
seems like there might be an advantage to seeing if I could remap
credential_definition_id to point to something else, much moreso than
making it look like a credential was created at a different time than it
really was.

Again, this isn't a patch review; I'm just curious if there's some
additional logic I'm missing here.

-- Matt

>  end
> -- 
> 1.7.10.2



More information about the aeolus-devel mailing list