protected_attributes 1.0.3 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7e99fd841a54df63ccc0d5147824eb665ef8396a
-  data.tar.gz: c37af9718bcd15937e1e195ae7c7bd3c742f728a
+  metadata.gz: 964c20fd28238f0df84ab69e92827a8db0068cfb
+  data.tar.gz: bbe6a5831c50e41147215618780498c91fa4f6bb
 SHA512:
-  metadata.gz: cd7137d9cfc8e5ef5d6263ecb4e82a94fbf4b66f7fd4d3fb2bd287b7dfb2a5ce04cb1bfd87fb4f84f42252c20ba86613f137afdff172673308fbaed950096ba2
-  data.tar.gz: 41c9d8e77b681dde22d0469685c9ef7d2aa1237a8ef86bf5ce40950a3028dbe727741e1ed352a7867115256924d0364dd39e3944a28bcdbc371f939429fa6c5e
+  metadata.gz: ea0d68ea0726d2b790cf7ac7c94abcca4c6654adabb24afc27e184827b7023019134205cef5b851d5edb85ad237568bb1811cca27f73db4947d86c253bfac777
+  data.tar.gz: 40217ce17158152775ba9373422af73d7e3747470f8b535414763814a4c967736d5c72ff7d0ecac305b1bcf38755306067b2b15dc3bab1abc16fc021cbf85d01

data/README.md

@@ -23,85 +23,86 @@ Or install it yourself as:
 Mass assignment security provides an interface for protecting attributes from end-user assignment. This plugin provides two class methods in your Active Record class to control access to your attributes. The `attr_protected` method takes a list of attributes that will not be accessible for mass-assignment. 
 
 For example:
-
-    attr_protected :admin
-
+```ruby
+attr_protected :admin
+```
 `attr_protected` also optionally takes a role option using `:as` which allows you to define multiple mass-assignment groupings. If no role is defined then attributes will be added to the `:default` role.
 
-    attr_protected :last_login, :as => :admin
-
+```ruby
+attr_protected :last_login, :as => :admin
+```
 A much better way, because it follows the whitelist-principle, is the `attr_accessible` method. It is the exact opposite of `attr_protected`, because it takes a list of attributes that will be accessible. All other attributes will be protected. This way you won’t forget to protect attributes when adding new ones in the course of development. Here is an example:
-
-    attr_accessible :name
-    attr_accessible :name, :is_admin, :as => :admin
-
+```ruby
+attr_accessible :name
+attr_accessible :name, :is_admin, :as => :admin
+```
 If you want to set a protected attribute, you will to have to assign it individually:
-
-    params[:user] # => {:name => "owned", :is_admin => true}
-    @user = User.new(params[:user])
-    @user.is_admin # => false, not mass-assigned
-    @user.is_admin = true
-    @user.is_admin # => true
-
+```ruby
+params[:user] # => {:name => "owned", :is_admin => true}
+@user = User.new(params[:user])
+@user.is_admin # => false, not mass-assigned
+@user.is_admin = true
+@user.is_admin # => true
+```
 When assigning attributes in Active Record using `attributes=` the `:default` role will be used. To assign attributes using different roles you should use `assign_attributes` which accepts an optional `:as` options parameter. If no `:as` option is provided then the `:default` role will be used. 
 You can also bypass mass-assignment security by using the `:without_protection` option. Here is an example:
+```ruby
+@user = User.new
 
-    @user = User.new
- 
-    @user.assign_attributes({ :name => 'Josh', :is_admin => true })
-    @user.name # => Josh
-    @user.is_admin # => false
- 
-    @user.assign_attributes({ :name => 'Josh', :is_admin => true }, :as => :admin)
-    @user.name # => Josh
-    @user.is_admin # => true
- 
-    @user.assign_attributes({ :name => 'Josh', :is_admin => true }, :without_protection => true)
-    @user.name # => Josh
-    @user.is_admin # => true
-
-In a similar way, `new`, `create`, `create!`, `update_attributes` and `update_attributes!` methods all respect mass-assignment security and accept either `:as` or `:without_protection` options. For example:
+@user.assign_attributes({ :name => 'Josh', :is_admin => true })
+@user.name # => Josh
+@user.is_admin # => false
 
-    @user = User.new({ :name => 'Sebastian', :is_admin => true }, :as => :admin)
-    @user.name # => Sebastian
-    @user.is_admin # => true
- 
-    @user = User.create({ :name => 'Sebastian', :is_admin => true }, :without_protection => true)
-    @user.name # => Sebastian
-    @user.is_admin # => true
+@user.assign_attributes({ :name => 'Josh', :is_admin => true }, :as => :admin)
+@user.name # => Josh
+@user.is_admin # => true
 
+@user.assign_attributes({ :name => 'Josh', :is_admin => true }, :without_protection => true)
+@user.name # => Josh
+@user.is_admin # => true
+```
+In a similar way, `new`, `create`, `create!`, `update_attributes` and `update_attributes!` methods all respect mass-assignment security and accept either `:as` or `:without_protection` options. For example:
+```ruby
+@user = User.new({ :name => 'Sebastian', :is_admin => true }, :as => :admin)
+@user.name # => Sebastian
+@user.is_admin # => true
+
+@user = User.create({ :name => 'Sebastian', :is_admin => true }, :without_protection => true)
+@user.name # => Sebastian
+@user.is_admin # => true
+```
 A more paranoid technique to protect your whole project would be to enforce that all models define their accessible attributes. 
 This can be easily achieved with a very simple application config option of:
-
-    config.active_record.whitelist_attributes = true
-
+```ruby
+config.active_record.whitelist_attributes = true
+```
 This will create an empty whitelist of attributes available for mass-assignment for all models in your app. 
 As such, your models will need to explicitly whitelist or blacklist accessible parameters by using an `attr_accessible` or `attr_protected` declaration. This technique is best applied at the start of a new project. However, for an existing project with a thorough set of functional tests, it should be straightforward and relatively quick to use this application config option; run your tests, and expose each attribute (via `attr_accessible` or `attr_protected`), as dictated by your failing test.
 
 For more complex permissions, mass-assignment security may be handled outside the model by extending a non-ActiveRecord class, such as a controller, with this behavior.
 
 For example, a logged-in user may need to assign additional attributes depending on their role:
-
-    class AccountsController < ApplicationController
-      include ActiveModel::MassAssignmentSecurity
-
-      attr_accessible :first_name, :last_name
-      attr_accessible :first_name, :last_name, :plan_id, :as => :admin
-
-      def update
-        ...
-        @account.update_attributes(account_params)
-        ...
-      end
-
-      protected
-
-      def account_params
-        role = admin ? :admin : :default
-        sanitize_for_mass_assignment(params[:account], role)
-      end
-    end
-
+```ruby
+class AccountsController < ApplicationController
+  include ActiveModel::MassAssignmentSecurity
+
+  attr_accessible :first_name, :last_name
+  attr_accessible :first_name, :last_name, :plan_id, :as => :admin
+
+  def update
+    ...
+    @account.update_attributes(account_params)
+    ...
+  end
+
+  protected
+
+  def account_params
+    role = admin ? :admin : :default
+    sanitize_for_mass_assignment(params[:account], role)
+  end
+end
+```
 ## Contributing
 
 1. Fork it

data/lib/active_record/mass_assignment_security/core.rb

@@ -1,22 +1,11 @@
 module ActiveRecord
   module MassAssignmentSecurity
     module Core
-      def initialize(attributes = nil, options = {})
-        defaults = self.class.column_defaults.dup
-        defaults.each { |k, v| defaults[k] = v.dup if v.duplicable? }
 
-        @attributes   = self.class.initialize_attributes(defaults)
-        @columns_hash = self.class.column_types.dup
+      private
 
-        init_internals
-        init_changed_attributes
-        ensure_proper_type
-        populate_with_current_scope_attributes
-
-        assign_attributes(attributes, options) if attributes
-
-        yield self if block_given?
-        run_callbacks :initialize unless _initialize_callbacks.empty?
+      def init_attributes(attributes, options)
+        assign_attributes(attributes, options)
       end
 
       def init_internals

data/lib/protected_attributes/version.rb

@@ -1,3 +1,3 @@
 module ProtectedAttributes
-  VERSION = "1.0.3"
+  VERSION = "1.0.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: protected_attributes
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.4
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-06-29 00:00:00.000000000 Z
+date: 2013-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -16,7 +16,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -26,7 +26,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -36,7 +36,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -46,7 +46,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -56,7 +56,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -66,7 +66,7 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.1.rc1
     - - <
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -160,7 +160,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0
+rubygems_version: 2.0.6
 signing_key: 
 specification_version: 4
 summary: Protect attributes from mass assignment in Active Record models