Question

I’m fairly new to rails and I am viewing some other’s code. I notice that if I attempt to create an instance of a model object using create() I get an error telling me that I cannot create model objects using mass assignment. I am aware of the dangers associated with mass assignment in object creation. However this does not seem to be necessary in some of the source I am using as a reference. Is this new to rails 3.2.7?? Or am I doing something incorrectly?

So if I have a model called “Person” and I want to create a new one:

person = Person.create(:first_name => "Some", :last_name => "Dude") #throws exception

What I have been doing is adding this to the Person class definition:

attr_accessible :first_name, :last_name

person = Person.create(:first_name => "Some", :last_name => "Dude") #now this is OK

Is defining the accessible attributes on each model class the correct way?

Thanks!

Answer 1

This is new in rails 3.2 due to the security upgrade. you can learn more at hackers love massignment

attr_accessible :first_name,  :last_name

http://api.rubyonrails.org/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html