CODEWITHSUNDEEP
ruby-on-railsruby
Unitech
Unitech

Reputation: 5981

Will Ruby On Rails 4 set by defaut config.active_record.whitelist_attributes to true?

Did RoR4 will set by default config.active_record.whitelist_attributes to true and some other securities values ?

Now I think RoR is enough simplified to integrates this kinds of constraints for securities reasons.

Thanks

Upvotes: 4

Views: 1969

Answers (2)

maletor
maletor

Reputation: 7122

...and it's gone. This is likely going to stay given Rails 4 has abstracted attr_accessible into a gem.

Upvotes: 3

Jesse Wolgamott
Jesse Wolgamott

Reputation: 40277

As of now, yes -- check it out:

https://github.com/rails/rails/blob/master/railties/lib/rails/generators/rails/app/templates/config/application.rb#L57

# Enforce whitelist mode for mass assignment.
# This will create an empty whitelist of attributes available for mass-assignment for all models
# in your app. As such, your models will need to explicitly whitelist or blacklist accessible
# parameters by using an attr_accessible or attr_protected declaration.
<%= comment_if :skip_active_record %>config.active_record.whitelist_attributes = true

Upvotes: 4

Related Questions