Re:IOS 6 injecting should_group_accessibility_children to PO...
by Pewpewarrows on Wednesday October 03, 2012 @11:27AM
(#4607878)
I'm a Python/Django guy so I'm not intimately familiar, but is that really the case? I was under the assumption that the handler wouldn't pass any POST vars not in attr_accessible to the model. In which case additional, unexpected ones would become silently dropped.
[ Parent
| on HN ]
Re:IOS 6 injecting should_group_accessibility_children to PO...
by masklinn on Wednesday October 03, 2012 @01:34PM
(#4608591)
According to http://guides.rubyonrails.org/security.html#countermeasures you're entirely correct that it won't raise any error, although the keys won't be dropped: attr_accessible drops the attributes when mass-assigned to a model, they're still available in the params hash.