Question

I decided to take a different approach to mass assigning for security reasons and wanted to know if this is a safe way to do it inside of the controller?

QuestionsController

def new
  @survey = Survey.find(params[:survey_id])
  @question = Question.new
end

def create
  @survey = Survey.find(params[:survey_id])
  @question = @survey.questions.new
  @question.title = params[:question][:title]
  @question.description = params[:question][:description]


  if @question.save
    redirect_to new_survey_question_path
  else
    render :new
  end
end

Can they change the survey_id or any other column of the question? Is their a better approach besides using attr_accessible?

Answer 1

Ok, you could do something like..

enabled_attributes = [:title, :description]
params[:question].delete_if {|k, v| !enabled_attributes.include?(k) }
@question = @survey.questions.new(params[:question])

This deletes from the params[:question] hash all the attributes that aren’t in the enabled array.