Security Article Part 2 - 5

user.rb

# Migration
create_table :users do |t|
  t.boolean :can_do_dangerous_things, null: false
  #...
  t.timestamps
end

class User < ActiveRecord::Base
  
  # Blacklisting attribute
  attr_protected :can_do_dangerous_things
  
  before_create do
    return true if @permissions_set
    
    self.permissions = {
      :can_do_dangerous_things => false
      #...
    } 
    
    true
  end
  
  def permissions=(hash)
    self.can_do_dangerous_things = hash[:can_do_dangerous_things]
    #...
    @permissions_set = true
  end
end