For a while, I have felt that the following is the correct way to improve the mass assignment problem without increasing the burden on new users. Now that the problem with the Rails default has been brought up again, it's a good time to revisit it.
When creating a form with form_for, include a signed token including all of the fields that were created at form creation time. Only these fields are allowed.
To allow new known fields to be added via JS, we could add:
| class PostsController < ActionController::Base | |
| def create | |
| Post.create(post_params) | |
| end | |
| def update | |
| Post.find(params[:id]).update_attributes!(post_params) | |
| end | |
| private |
| #!/bin/bash | |
| # CentOS rbenv system wide installation script | |
| # Forked from https://gist.github.com/1237417 | |
| # Installs rbenv system wide on CentOS 5/6, also allows single user installs. | |
| # Install pre-requirements | |
| yum install -y gcc-c++ patch readline readline-devel zlib zlib-devel libyaml-devel libffi-devel openssl-devel \ | |
| make bzip2 autoconf automake libtool bison iconv-devel git-core |
