Question

Just want to be clear on what mass assignment is and how to code around it. Is mass assignment the assignment of many fields using a hash, ie like..

@user = User.new(params[:user])

And to prevent this you use attr_accessible like:

attr_accessible :name, :email

So that a field like :admin could not be added by mass assignment?

But we can modify it in code by something like:

@user.admin = true

So is it true that if we don’t have attr_accessible then everything is accessible for mass assignment?

And finally the tricky point … is it true that even with one attr_accessible like “attr_accessible :name” means that all other fields are now not accessible for mass assignment?

Answer 1

All of your assumptions are correct. Without attr_accessible, all fields are open to mass assignment. If you start using attr_accessible, only the fields you specify are open to mass assignment.