ryanb / trusted-params Goto Github PK

:'(

I want trusted-params in my Gemfile, please :-)

rails 2.3.11

DEPRECATION WARNING: metaclass is deprecated and will be removed from Rails 2.3 (use singleton_class instead). (called from extended at /my_path/vendor/plugins/trusted-params/lib/trusted_params/active_record_additions.rb:21)

how can fix this?

Take delayed_job for example. It sets priority and other metadata to its internal Delayed::Job model. Of course this causes an error, unless I add .trust to its hashes or set attr_accessible :all on delayed job's model. I've been thinking about a way to work around that, and found that the only reasonable place to guard against external params is in controllers. Maybe it makes sense to explicitly check where method #trusted? is being called, and always return true unless its context is_a?(ActionController::Base). Everywhere else you're pretty much on your own - since developer should be allowed to freely exchange params internally. If someone sets user-supplied attributes anywhere but in their controller - well then ... they suck.

I've a date attribute birthday, that I update through date_select

I get "attribute "birthday(3i)" is protected from mass assignment, use attr_accessible
and obviuslly I used attr_accessible for :birthday.

I worked around through attr_accessible "birthday(3i)", "birthday(2i)", "birthday(1i)"