memento 0.4.0 → 0.4.1

data/.rbenv-version

@@ -1 +1 @@
-1.9.3-p194
+1.9.3-p286

data/CHANGES.md

@@ -1,6 +1,12 @@
 ### dev
 
-[full changelog](http://github.com/yolk/valvat/compare/v0.4.0...master)
+[full changelog](http://github.com/yolk/valvat/compare/v0.4.1...master)
+
+### 0.4.1 / 2012-11-01
+
+[full changelog](http://github.com/yolk/valvat/compare/v0.4.0...v0.4.1)
+
+* Prevent all mass assignment to Memento::Session and Memento::State
 
 ### 0.4.0 / 2012-10-29
 

data/lib/memento.rb

@@ -21,7 +21,7 @@ module Memento
 
     def start(user_or_id)
       user = user_or_id.is_a?(User) ? user_or_id : User.find_by_id(user_or_id)
-      self.session = user ? Memento::Session.new(:user => user) : nil
+      self.session = user ? Memento::Session.new({:user => user}, :without_protection => true) : nil
     end
 
     def stop

data/lib/memento/session.rb

@@ -4,6 +4,9 @@ module Memento
 
     has_many :states, :class_name => "Memento::State", :dependent => :delete_all, :order => "id DESC"
     belongs_to :user
+
+    attr_accessible nil
+
     validates_presence_of :user
 
     def add_state(action_type, record)

data/lib/memento/state.rb

@@ -5,6 +5,8 @@ module Memento
     belongs_to :session, :class_name => "Memento::Session"
     belongs_to :record, :polymorphic => true
 
+    attr_accessible nil
+
     validates_presence_of :session
     validates_presence_of :record
     validates_presence_of :action_type
@@ -13,7 +15,9 @@ module Memento
     before_create :set_record_data
 
     def self.store(action_type, record)
-      self.new(:action_type => action_type.to_s, :record => record) do |state|
+      new do |state|
+        state.action_type = action_type.to_s
+        state.record = record
         state.save if state.fetch?
       end
     end

data/lib/memento/version.rb

@@ -1,3 +1,3 @@
 module Memento
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

data/spec/memento/session_spec.rb

@@ -5,7 +5,7 @@ describe Memento::Session do
   before do
     setup_db
     setup_data
-    @session = Memento::Session.create(:user => @user)
+    @session = Memento::Session.create({:user => @user}, :without_protection => true)
   end
 
   it "should belong to user" do
@@ -18,15 +18,23 @@ describe Memento::Session do
 
   it "should have_many states" do
     @session.states.should eql([])
-    @session.states.create!(:action_type => "destroy", :record => Project.create!)
+    @session.states.create!({:action_type => "destroy", :record => Project.create!}, :without_protection => true)
     @session.states.count.should eql(1)
   end
 
+  it "should disallow all mass assignment" do
+    Memento::Session.accessible_attributes.deny?("id").should eql(true)
+    Memento::Session.accessible_attributes.deny?("created_at").should eql(true)
+    Memento::Session.accessible_attributes.deny?("updated_at").should eql(true)
+    Memento::Session.accessible_attributes.deny?("user_id").should eql(true)
+    Memento::Session.accessible_attributes.deny?("user").should eql(true)
+  end
+
   context "undo" do
     before do
-      @state1 = @session.states.create!(:action_type => "update", :record => @p1 = Project.create!)
-      @other = Memento::Session.create!(:user => @user).states.create!(:action_type => "destroy", :record => Project.create!)
-      @state2 = @session.states.create!(:action_type => "update", :record => @p2 = Project.create!)
+      @state1 = @session.states.create!({:action_type => "update", :record => @p1 = Project.create!}, :without_protection => true)
+      @other = Memento::Session.create!({:user => @user}, :without_protection => true).states.create!({:action_type => "destroy", :record => Project.create!}, :without_protection => true)
+      @state2 = @session.states.create!({:action_type => "update", :record => @p2 = Project.create!}, :without_protection => true)
     end
 
     describe "and all states succeed" do
@@ -47,9 +55,9 @@ describe Memento::Session do
 
     describe "and all states fail" do
       before do
-        @state1.update_attributes(:record_data => {:name => ["A", "B"]})
+        @state1.update_attributes({:record_data => {:name => ["A", "B"]}}, :without_protection => true)
         @p1.update_attributes(:name => "C")
-        @state2.update_attributes(:record_data => {:name => ["A", "B"]})
+        @state2.update_attributes({:record_data => {:name => ["A", "B"]}}, :without_protection => true)
         @p2.update_attributes(:name => "C")
       end
 
@@ -70,7 +78,7 @@ describe Memento::Session do
 
     describe "and some states succeed, some fail" do
       before do
-        @state1.update_attributes(:record_data => {:name => ["A", "B"]})
+        @state1.update_attributes({:record_data => {:name => ["A", "B"]}}, :without_protection => true)
         @p1.update_attributes(:name => "C")
       end
 
@@ -101,9 +109,9 @@ describe Memento::Session do
 
   describe "with states" do
     before do
-      @session.states.create!(:action_type => "destroy", :record => Project.create!)
-      Memento::Session.create!(:user => @user).states.create!(:action_type => "destroy", :record => Project.create!)
-      @state2 = @session.states.create!(:action_type => "update", :record => Project.create!)
+      @session.states.create!({:action_type => "destroy", :record => Project.create!}, :without_protection => true)
+      Memento::Session.create!({:user => @user}, :without_protection => true).states.create!({:action_type => "destroy", :record => Project.create!}, :without_protection => true)
+      @state2 = @session.states.create!({:action_type => "update", :record => Project.create!}, :without_protection => true)
     end
 
     it "should destroy all states when destroyed" do

data/spec/memento/state_spec.rb

@@ -5,11 +5,11 @@ describe Memento::State do
   before do
     setup_db
     setup_data
-    @session = Memento::Session.create(:user => @user)
+    @session = Memento::Session.create({:user => @user}, :without_protection => true)
   end
 
   it "should belong to session" do
-    Memento::State.new(:session => @session).session.should eql(@session)
+    Memento::State.new({:session => @session}, :without_protection => true).session.should eql(@session)
   end
 
   it "should require session" do
@@ -18,22 +18,32 @@ describe Memento::State do
 
   it "should require action_type to be one of Memento::State::RECORD_CAUSES" do
     Memento::State.create.errors[:action_type].should eql(["can't be blank"])
-    Memento::State.create(:action_type => "move").errors[:action_type].should eql(["is not included in the list"])
+    Memento::State.create({:action_type => "move"}, :without_protection => true).errors[:action_type].should eql(["is not included in the list"])
   end
 
   it "should belong to polymorphic record" do
-    Memento::State.new(:record => @user).record.should eql(@user)
-    Memento::State.new(:record => @session).record.should eql(@session)
+    Memento::State.new({:record => @user}, :without_protection => true).record.should eql(@user)
+    Memento::State.new({:record => @session}, :without_protection => true).record.should eql(@session)
   end
 
   it "should require record" do
     Memento::State.create.errors[:record].should eql(["can't be blank"])
   end
 
+  it "should disallow all mass assignment" do
+    Memento::State.accessible_attributes.deny?("id").should eql(true)
+    Memento::State.accessible_attributes.deny?("created_at").should eql(true)
+    Memento::State.accessible_attributes.deny?("updated_at").should eql(true)
+    Memento::State.accessible_attributes.deny?("session_id").should eql(true)
+    Memento::State.accessible_attributes.deny?("session").should eql(true)
+    Memento::State.accessible_attributes.deny?("record_id").should eql(true)
+    Memento::State.accessible_attributes.deny?("record_type").should eql(true)
+    Memento::State.accessible_attributes.deny?("record").should eql(true)
+  end
 
   describe "valid State" do
     before do
-      @state = @session.states.create!(:action_type => "destroy", :record => @project = Project.create(:name => "A") )
+      @state = @session.states.create!({:action_type => "destroy", :record => @project = Project.create(:name => "A")}, :without_protection => true )
     end
 
     it "should give back Memento::Result on undo" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: memento
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-10-29 00:00:00.000000000 Z
+date: 2012-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord