ari/jobsworth — Issue #292: Review mass update security
Author: ari
Created: 2012-03-05 22:11:16+00:00
State: open

Although Anatoliy already patched this hole more than a year ago, let's review this again just to make sure. Here is the new recommended approach which we should implement now:

https://github.com/rails/rails/commit/641a4f62405cc2765424320932902ed8076b5d38

and here is the commit where we fixed this bug:

https://github.com/ari/jobsworth/commit/3d277cacfcca0fd529e61dfa420cec1969e40e2c

Liu, please give this another review and see if recent versions of devise and other schema changes have opened up new holes. Let's make sure the default is locked down.