[PATCH conductor] rm3343: credential: make attributes accessible/protected
Matt Wagner
matt.wagner at redhat.com
Fri Jun 1 19:23:28 UTC 2012
On Fri, Jun 01, 2012 at 04:54:43PM +0200, mzatko at redhat.com wrote:
> From: Maros Zatko <mzatko at redhat.com>
>
> ---
> src/app/models/credential.rb | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/src/app/models/credential.rb b/src/app/models/credential.rb
> index 4b06a36..a52319c 100644
> --- a/src/app/models/credential.rb
> +++ b/src/app/models/credential.rb
> @@ -34,4 +34,7 @@ class Credential < ActiveRecord::Base
> validates_presence_of :credential_definition_id
> validates_presence_of :value
> validates_uniqueness_of :credential_definition_id, :scope => :provider_account_id
> +
> + attr_protected :id, :provider_account_id, :created_at
> + attr_accessible :value, :credential_definition_id
This is not a review, but I'm just curious -- how are we deciding what
attributes get protected? It's not quite intuitive to me why we're
protected :created_at (but not :updated_at), but allowing
:credential_definition_id to be mass-assigned. If I were an attacker it
seems like there might be an advantage to seeing if I could remap
credential_definition_id to point to something else, much moreso than
making it look like a credential was created at a different time than it
really was.
Again, this isn't a patch review; I'm just curious if there's some
additional logic I'm missing here.
-- Matt
> end
> --
> 1.7.10.2
More information about the aeolus-devel
mailing list