IOS 6 injecting should_group_accessibility_children to POST requests

Re:IOS 6 injecting should_group_accessibility_children to PO... by untog on Wednesday October 03, 2012 @10:43AM (#4607617)

I'm not a Rails guy, so you'll have to forgive ignorance here. Are you telling me that Rails only lets you blacklist parameters, not whitelist?

Because that seems entirely the wrong way around.

EDIT: looked at the link posted elsewhere here[1] and ound that it is possible to whitelist using "attr_accessible". Please tell me people know about and use this.

[1] http://guides.rubyonrails.org/security.html#mass-assignment

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by bryanlarsen on Wednesday October 03, 2012 @10:45AM (#4607628)

You can do either. The default used to be blacklist, but that was changed to whitelist recently.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by bob_p on Wednesday October 03, 2012 @10:45AM (#4607630)

You can do either. Whitelist is obviously preferred.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by alanpca on Wednesday October 03, 2012 @10:46AM (#4607632)

It allows either.

[ Parent | on HN ]