sferik/rails_admin — Issue #839: User's roles edition needs mass assignment which leeds to major security issue
Author: jerefrer
Created: 2011-11-17 14:26:22+00:00
State: open

I'm using CanCan here, but this would be a common issue for other authentication systems I guess.

In my app I'd like to allow admins to edit the roles of other users, so I allowed the guys with admin role to :

````
can :manage, User
can :read, Role (apparently needed by RailsAdmin just to list the roles in the HABTM form and therefore allow edition)
````

but that wasn't working, so I googled around and [found that I needed to add :role_ids to the attr_accessible fields in my User model](http://groups.google.com/group/rails_admin/browse_thread/thread/2bca934168a70e11/9b330aa1ef2f98ea?show_docid=9b330aa1ef2f98ea).

And indeed it's now working.

But what I realized a bit later is that **it's a major security issue since anyone can just mass-assign it's roles !**

I then googled a bit to see if there was some way to define a dynamic attr_accessible, and then found this [Railscasts](http://asciicasts.com/episodes/237-dynamic-attr-accessible) explaining the use of the mass_assignment_authorizer method, so I added this to my User model :

````
private
def mass_assignment_authorizer
super + [:role_ids]
end
````

And since it's now preventing a user from mass-assigning his roles (unless he is admin), I lost the ability to edit them in the RailsAdmin window.

Any idea how I could have both a secure app and an easy and RailsAdmin-ish way to change my users roles ?