richardkmichael/rails — Issue #8: Update mass-assignment documention
Author: richardkmichael
Created: 2012-03-04 00:30:46+00:00
State: open

http://guides.rubyonrails.org/security.html#mass-assignment

Needs a mention of the Rails 3.2 default for the development and test environments which now use:

`config.active_record.mass_assignment_sanitizer = :strict`

Because, the code in *6.1 Countermeasures* will now raise an exception, not run as shown.

```ruby
params[:user] # => {:name => "ow3ned", :admin => true}
@user = User.new(params[:user])
@user.admin # => false # not mass-assigned
@user.admin = true
@user.admin # => true
```