Question

Did RoR4 will set by default config.active_record.whitelist_attributes to true and some other securities values ?

Now I think RoR is enough simplified to integrates this kinds of constraints for securities reasons.

Thanks

Answer 1

As of now, yes — check it out:

https://github.com/rails/rails/blob/master/railties/lib/rails/generators/rails/app/templates/config/application.rb#L57

# Enforce whitelist mode for mass assignment.
# This will create an empty whitelist of attributes available for mass-assignment for all models
# in your app. As such, your models will need to explicitly whitelist or blacklist accessible
# parameters by using an attr_accessible or attr_protected declaration.
<%= comment_if :skip_active_record %>config.active_record.whitelist_attributes = true