IOS 6 injecting should_group_accessibility_children to POST requests

Re:IOS 6 injecting should_group_accessibility_children to PO... by masklinn on Wednesday October 03, 2012 @10:54AM (#4607677)

> Mass assignment is a fairly normal thing to do

No, it's an abnormal thing to do and a security hole.

> any parameters you want the model to ignore can be marked as so

Which is complete insanity.

> Rails loves DRY.

Yes so does PHP, hence register_globals.

That's on the "idiotic" side of "I don't want to write stuff", and even the Rails staff stopped defending this insanity back in March.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by tomjen3 on Wednesday October 03, 2012 @11:14AM (#4607806)

If you want to argue against facts, please go elsewhere. Mass assignment is widely used in Rails.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by untog on Wednesday October 03, 2012 @11:16AM (#4607819)

Just because something is widely used does not mean it is not a security hole. Mass assignment is a security hole, plain and simple- in Rails and anywhere else.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by masklinn on Wednesday October 03, 2012 @01:29PM (#4608561)

> Mass assignment is widely used in Rails.

And register_globals was widely used in PHP, that does not make it anything but moronic.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by eli on Wednesday October 03, 2012 @01:45PM (#4608653)

I don't think register_globals has been widely used for at least 10 or 12 years. It's been deprecated for a while and was removed completely in 5.4.0.

[ Parent | on HN ]

Re:IOS 6 injecting should_group_accessibility_children to PO... by masklinn on Thursday October 04, 2012 @03:59AM (#4611343)

Hence "was". It was widely used at one point, if only because it was enabled by default until 2002 (disabled by default was introduced in PHP 4.2)

[ Parent | on HN ]