#237 Dynamic attr_accessible

Oct 25, 2010 | 9 minutes | Security, Models, Rails 3.0

It is important to use attr_accessible for security with mass assignment, but what if you need it to be dynamic based on user permissions? See how in this episode.

Click to Play Video ▶

Download:
source codeProject Files in Zip (108 KB)
mp4Full Size H.264 Video (16.7 MB)
m4vSmaller H.264 Video (10.7 MB)
webmFull Size VP8 Video (25.9 MB)
ogvFull Size Theora Video (24.3 MB)

Browse Source Code

Resources

          config/initializers/accessible_attributes.rb
        
class ActiveRecord::Base
  attr_accessible
  attr_accessor :accessible
  
  private
  
  def mass_assignment_authorizer
    if accessible == :all
      self.class.protected_attributes
    else
      super + (accessible || [])
    end
  end
end

          models/article.rb
        
class Article < ActiveRecord::Base
  attr_accessible :name, :content
end

          articles_controller.rb
        
def create
  @article = Article.new
  @article.accessible = :all if admin?
  @article.attributes = params[:article]
  if @article.save
    flash[:notice] = "Successfully created article."
    redirect_to @article
  else
    render :action => 'new'
  end
end

def update
  @article = Article.find(params[:id])
  @article.accessible = :all if admin?
  if @article.update_attributes(params[:article])
    flash[:notice] = "Successfully updated article."
    redirect_to @article
  else
    render :action => 'edit'
  end
end