NoamB/sorcery — Issue #212: authenticates_with_sorcery! breaks attr_accessible
Author: sjmadsen
Created: 2012-02-13 20:41:50+00:00
State: open

I have a new Rails 3.2.1 app I'm starting, with a `User` model. I have set `config.active_record.whitelist_attributes = true` in my `application.rb` to get mass-assignment protection by default, without needing to remember to set `attr_accessible` (which I'll do, but now I have something that will loudly break when I forget).

I discovered a disturbing problem today. If `authenticates_with_sorcery!` appears _after_ `attr_accessible` in my model, it effectively disables the whitelist entirely, and I can mass-assign to any attribute without errors.

If I switch the order so that `authenticates_with_sorcery!` is _before_ `attr_accessible`, everything works as expected and Rails raises an exception if I try to mass-assign to something I shouldn't. Things work properly if the model lacks `attr_accessible`, too.

There are instructions in the activity logging submodule to add its attributes to `attr_accessible`, but nothing mentions that ordering is important. It's not good if Sorcery overrides the whitelist.