usergrid_ironhorse 0.0.4 → 0.0.5

data/README.md

@@ -149,6 +149,10 @@ usergrid_ironhorse/spec/spec_settings.yaml to match.)
 
 ## Release notes
 
+### 0.0.5
+* New Features
+  1. support MassAssignmentSecurity (attr_accessible & attr_protected)
+
 ### 0.0.4
 * New Features
   1. add require_login to config (with ability to skip individual logins)

data/lib/usergrid_ironhorse/base.rb

@@ -11,6 +11,7 @@ module Usergrid
       include ActiveModel::Validations
       include ActiveModel::Dirty
       include ActiveModel::Serialization
+      include ActiveModel::MassAssignmentSecurity
       extend  ActiveModel::Naming
       extend  ActiveModel::Callbacks
 
@@ -42,11 +43,8 @@ module Usergrid
       RecordNotSaved = ActiveRecord::RecordNotSaved
 
       def initialize(attrs=nil)
-        attrs = HashWithIndifferentAccess.new attrs
-        unless attrs.has_key? :uuid
-          assign_attributes attrs
-        end
-        @attributes = attrs
+        @attributes = HashWithIndifferentAccess.new
+        assign_attributes attrs if attrs
       end
 
       def self.configure!(application_url, auth_token)
@@ -279,6 +277,7 @@ module Usergrid
 
 
       def assign_attributes(attrs)
+        attrs = sanitize_for_mass_assignment(attrs)
         attrs.each do |attr,value|
           attr = attr.to_s
           unless attributes[attr] == value

data/lib/usergrid_ironhorse/version.rb

@@ -1,5 +1,5 @@
 module Usergrid
   module Ironhorse
-    VERSION = '0.0.4'
+    VERSION = '0.0.5'
   end
 end

data/spec/usergrid_ironhorse/base_spec.rb

@@ -310,5 +310,25 @@ describe Usergrid::Ironhorse::Base do
       foo.destroy
     end
 
+    it "should fail on unaccessible mass assignment" do
+      Foo.attr_accessible :name
+      foo = Foo.create! name: 'foo', number: 43
+      foo.number.should_not eq 43
+      foo.update_attributes number: 44, foo: 'bar'
+      foo.number.should_not eq 44
+      foo.destroy
+      Foo._accessible_attributes = nil
+    end
+
+    it "should fail on protected mass assignment" do
+      Foo.attr_protected :number
+      foo = Foo.create! name: 'foo', number: 43
+      foo.number.should_not eq 43
+      foo.update_attributes number: 44, foo: 'bar'
+      foo.number.should_not eq 44
+      foo.destroy
+      Foo._protected_attributes = nil
+    end
+
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usergrid_ironhorse
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-11-16 00:00:00.000000000 Z
+date: 2012-12-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: usergrid_iron