rails/rails — comment on commit 06a3a8a458e70c1b6531ac53c57a302b162fd736
File:  line 0
By eval:

@drogus yes, but once you define any role (say 'attr_accessible :name, :as => :possibly_malicious_user_input') i.e. specifically for mass-assignments in controllers, there's no way to ignore roles in other parts of your code (e.g. tests, working in console, whole lot's of non-controller code).

Ways to workaround are
1. use ':without_protection => true' (cumbersome),
2. explicitly (re)define all attributes to be attr_accessible for some other role, maybe 'default' (hard to maintain when adding attributes).

This gem helps with 2) in that you can define a role that has always access to all attributes. Maybe better: When doing 'sudo_attr_accessible_as :default' code can be role-unaware by default.