Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
张重言
rails
提交
af981764
R
rails
项目概览
张重言
/
rails
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
R
rails
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
af981764
编写于
3月 16, 2014
作者:
R
Robin Dupret
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Remove extra white-spaces [ci skip]
Follow up to
024e5e31
上级
e9625d63
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
13 addition
and
13 deletion
+13
-13
guides/source/getting_started.md
guides/source/getting_started.md
+13
-13
未找到文件。
guides/source/getting_started.md
浏览文件 @
af981764
...
...
@@ -749,32 +749,32 @@ article. Try it! You should get an error that looks like this:
Rails has several security features that help you write secure applications,
and you're running into one of them now. This one is called
`[strong_parameters](http://guides.rubyonrails.org/action_controller_overview.html#strong-parameters)`
,
`[strong_parameters](http://guides.rubyonrails.org/action_controller_overview.html#strong-parameters)`
,
which requires us to tell Rails exactly which parameters are allowed into
our controller actions.
Why do you have to bother? The ability to grab and automatically assign
all controller parameters to your model in one shot makes the programmer's
job easier, but this convenience also allows malicious use.
What if a
request to the server was crafted to look like a new article form submit
but also included extra fields with values that violated your applications
integrity? They would be 'mass assigned' into your model and then into the
all controller parameters to your model in one shot makes the programmer's
job easier, but this convenience also allows malicious use.
What if a
request to the server was crafted to look like a new article form submit
but also included extra fields with values that violated your applications
integrity? They would be 'mass assigned' into your model and then into the
database along with the good stuff - potentially breaking your application
or worse.
We have to whitelist our controller parameters to prevent wrongful
mass assignment.
In this case, we want to both allow and require the
`title`
and
`text`
parameters for valid use of
`create`
.
The syntax for
We have to whitelist our controller parameters to prevent wrongful
mass assignment.
In this case, we want to both allow and require the
`title`
and
`text`
parameters for valid use of
`create`
. The syntax for
this introduces
`require`
and
`permit`
. The change will involve one line:
```
ruby
@article
=
Article
.
new
(
params
.
require
(
:article
).
permit
(
:title
,
:text
))
```
This is often factored out into its own method so it can be reused by
This is often factored out into its own method so it can be reused by
multiple actions in the same controller, for example
`create`
and
`update`
.
Above and beyond mass assignment issues, the method is often made
`private`
to make sure it can't be called outside its intended context.
Above and beyond mass assignment issues, the method is often made
`private`
to make sure it can't be called outside its intended context.
Here is the result:
```
ruby
...
...
@@ -791,7 +791,7 @@ private
end
```
TIP: For more information, refer to the reference above and
TIP: For more information, refer to the reference above and
[
this blog article about Strong Parameters
](
http://weblog.rubyonrails.org/2012/3/21/strong-parameters/
)
.
### Showing Articles
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录