ryanb/cancan — Issue #513: Cancan 2.0: attributes authorization check with AR:Dirty instead of params hash
Author: gamov
Created: 2011-11-14 04:16:43+00:00
State: open

Hello,
This is a suggestion, I don't know how feasible it is...
The current implementation only checks if the parameters present in params hash are authorized, not if those are actually changing the model. If you supply along **non-model changing** parameters that are not authorized, Cancan will not authorize the update.
It might be too 'deep' for Cancan to go and check on the model dirtiness but it will simplify the views because with the current implementation, you need to put a lot of 'if can?' to be sure you are not supplying unauthorized params for the current role.
Basically, it would be great if we could supply the same form for all roles and Cancan checks authorized attributes change on their dirtiness.