(black list)
class SomeModel(white list)
attr_protected :admin
...
end
class SomeModel
attr_accessible :name
...
end
I learned from the book Programming Microsoft® ASP.NET MVC, Second Edition that we should protect mass assignment with defining attribute on argument of Action method, not on Model directly.
(black list)
[HttpPost](white list)
public ActionResult Create([Bind(Exclude="admin")]SomeModel model)
{
...
}
[HttpPost]
public ActionResult Create([Bind(Include="name")]SomeModel model)
{
...
}
The best advantage of this approach is to be able to define black lists or white lists in each actions.
No comments:
Post a Comment