preventing active record attributes from being modified by forms

Question

In Ruby on Rails, it's very easy to update a model from an HTML form. Usually you can just create a form_for with the model, and the fields in there will be updated when the user hits the submit button.

Say though that a malicious user wants to update their 'salary' without going through the proper channels. couldn't they just inject a field by the name of 'salary' when updating their email address (for example) and set their pay to basically be whatever they want? how do i specify which fields can be modified and which can't to prevent this?

Seeing things like

@user.update_attributes(params[:user])

seems scary. They could update anything. I understand the use of attr_accessible, but that's only relevant for mass updates, isn't it?

Richard Brown · Accepted Answer · 2013-03-20 20:42:46Z

2

You can restrict what fields can be mass assigned using:

attr_accessible :name, :address # no :salary

answered Mar 20, 2013 at 20:42

Richard Brown

11.4k4 gold badges34 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Larry Over a year ago

right, but couldn't the user just post the one :salary field instead of everything? or does update_attributes always follow attr_accessible?

Richard Brown Over a year ago

attr_accessible lists the fields that are allowed to be mass-assigned, such as using update_attributes. They can't assign the value because of that.

Collectives™ on Stack Overflow

preventing active record attributes from being modified by forms

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related