Hacker News new | ask | show | jobs
ActiveRecord 3.1 - Mass-Assignment Roles (ablogaboutcode.com)
16 points by panthomakos 5517 days ago
3 comments

Write up a patch? It may be a little late in the game to be changing APIs, but it might be ok since it's just beta 1.
This month's Communications of the ACM has a good article by Patrick McKenzie on Rails security, and the mass assignment vulnerability in particular.
Chaining the role would make it easier to add the role to inherited_resources, you'd just need to add it to your beginning_of_association_chain