Skip to content

Instantly share code, notes, and snippets.

@jbarnette
Created March 5, 2012 02:37
Show Gist options
  • Save jbarnette/1976133 to your computer and use it in GitHub Desktop.
Save jbarnette/1976133 to your computer and use it in GitHub Desktop.
class ActiveRecord::Base
attr_accessible nil
def update_attributes *args
raise "Don't call #{self.class.name}#update_attributes. " +
"Mass assignment is pure evil."
end
end
@sgruhier
Copy link

sgruhier commented Mar 5, 2012

efficient !

@mhuggins
Copy link

mhuggins commented Apr 3, 2012

Can you clarify why update_attributes is bad? The Rails Security Guide states:

In a similar way, new, create, create!, update_attributes, and update_attributes! methods all respect mass-assignment security and accept either :as or :without_protection options.

Given that, I fail to see why disabling update_attributes is necessary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment