Comments on Stochastic Bytes: Rail Plugin: param_protected

Got rid of that ridiculous syntax to deal with nes...

2009-03-17T15:39:00.000-05:00

Got rid of that ridiculous syntax to deal with nested params:
param_protected ["user", "user/id", "user/password"]

Now you just say:
param_protected :user => [:id, :password]

Ok, I implemented whitelisting (param_accessible) ...

2008-03-24T22:00:00.000-05:00

Ok, I implemented whitelisting (param_accessible) and also the features I talked about in the previous comment.

Please see the README for documentation.

Hello mina,Yes, param_accessible is in the works. ...

2008-03-11T02:09:00.000-05:00

Hello mina,

Yes, param_accessible is in the works. I'm also working on cleaning up the code and making it more efficient, but the big feature is having it work with arrays...

For example you have a form with inputs like this:
<input name="names[][first]" />
<input name="names[][middle]" />
<input name="names[][last]" />

And thus params that come across like:
{ :names => [ {:first => Jane, :middle => Rae, :last => Doe}, {:first => John, :middle => Rambo, :last => Doe} ] }

Then you can say:
param_protected 'names/middle'

And it will trim the params to:
{ :names => [ {:first => Jane, :last => Doe}, {:first => John, :last => Doe} ] }

Hopefully I can knock that out in a couple weeks.

Very cool work Christopher (especially with the ne...

2008-03-10T15:40:00.000-05:00

Very cool work Christopher (especially with the nested stuff). I completely agree with your sentiments. I still think there's still a place for attr_protected in the model for truly immutable attributes like :id, but the rest of the filtering is more suited as you've mentioned in the controller.

My beef though with attr_protect (and param_protected) is that they're blacklists which, in case of filtering, are much less effective security-wise compared to whitelists.

Do you have plans for a param_allowed ;-) ?

Alright, it now works with nested params.param_pro...

2008-01-21T20:57:00.000-06:00

Alright, it now works with nested params.

param_protected 'user/user_id'

will now remove params[:user][:user_id].

This has not been extensively tested, so please let me know about any bugs.