Question

How can I exclude (or explicitly include) params passed to an object like in the following example:

  def create
    @something = Something.new(params[:something])
    ...
    @something.save    
  end

Say for example something had a field trust_level that should not be settable through public users (which are allowed to create the object). It would be easy to send this field via HTTP even if the provided form doesn’t contain it. So how can be prevented that this field is passed to the new (or update_attributes) method?

Answer 1

Use attr_accessible to define what’s available to mass-assignment.

(That’s a link to the docs but it’s a little hard to tell, so here it is again.)