kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Merge pull request #5049 from fabioyamate/master

Browse source 
Fix sanitize_for_mass_assigment when role is nil
This commit is contained in:
José Valim 2012-02-15 05:21:20 -08:00
commit 1c22c6f0d4
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
activemodel/lib/active_model/mass_assignment_security.rb
View file

@ -226,12 +226,12 @@ module ActiveModel
protected
def sanitize_for_mass_assignment(attributes, role = :default)
def sanitize_for_mass_assignment(attributes, role = nil)
_mass_assignment_sanitizer.sanitize(attributes, mass_assignment_authorizer(role))
end
def mass_assignment_authorizer(role = :default)
self.class.active_authorizer[role]
def mass_assignment_authorizer(role)
self.class.active_authorizer[role || :default]
end
end
end

7
activemodel/test/cases/mass_assignment_security_test.rb
View file

@ -19,6 +19,13 @@ class MassAssignmentSecurityTest < ActiveModel::TestCase
assert_equal expected, sanitized
end
def test_attribute_protection_when_role_is_nil
user = User.new
expected = { "name" => "John Smith", "email" => "john@smith.com" }
sanitized = user.sanitize_for_mass_assignment(expected.merge("admin" => true), nil)
assert_equal expected, sanitized
end
def test_only_moderator_role_attribute_accessible
user = SpecialUser.new
expected = { "name" => "John Smith", "email" => "john@smith.com" }