[Rails] Re: Avoiding a mass assignment security flaw while assigning user roles

2012-04-29 Thread Frederick Cheung
On Apr 29, 9:48 pm, Mohamad El-Husseini wrote: > I have User, Account, and Role models. Role stores the relationship type > between Account and User. > > I know that *attr_accessible* should be blank in the Role model to prevent > attackers from changing either the role type (owner, > admin, mod

[Rails] Re: Avoiding a mass assignment security flaw while assigning user roles

2012-04-29 Thread Mohamad El-Husseini
After doing my own research, it looks like I can approach this two ways: 1. Episode 237, Railscasts, Dynamic att_accessible, overriding mass_assignment_authorizer 2. I can use attr_accessible role, as: :admin I would appreciate it if anyone can elaborate on the merits of either approach. On S

[Rails] Avoiding a mass assignment security flaw while assigning user roles

2012-04-29 Thread Mohamad El-Husseini
I have User, Account, and Role models. Role stores the relationship type between Account and User. I know that *attr_accessible* should be blank in the Role model to prevent attackers from changing either the role type (owner, admin, moderator, subscriber), account, or user ids. But what if an

[Rails] Tumblr

2012-04-29 Thread bertly_the_coder
Hi guys, I'm trying to do something that should be relatively simple. I have a site that posts to social sites. So far I have it posting to twitter with: https://twitter.com/share?original_referer=http://localhost:3000/members/shared_from_twitt&text=Check%20out%20the%20new%20%23sxsw%20versus%20w/

[Rails] Re: Make every little piece a model.

2012-04-29 Thread CavalryJim
On Apr 27, 4:09 pm, masta Blasta wrote: > I'm considering making every little piece of editable content on my site > a model with it's own table. > > So if you think of a blog post for example, the title, subject, body, > whateverwould be a separate table. With the proper associations of > c

[Rails] Server starting failed (ruby 1.9.3p194, rails 3.2.3 )

2012-04-29 Thread JoongSeob VIto Kim
Server starting failed (ruby 1.9.3p194, rails 3.2.3 ) Attachments: http://www.ruby-forum.com/attachment/7346/ruby193err.txt -- Posted via http://www.ruby-forum.com/. -- You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this grou