UnionOfRAD/lithium — Issue #370: Protect to mass-assignment vulnerability?
Author: Leechael
Created: 2012-03-09 10:00:16+00:00
State: open

Since this problem exists for a long time, codes like:

```PHP

if ($this->request->data) {
$success = $entity->save($this->request->data);
}

```

When we can not guarantee fields that no along modified in this controller/action or this session (relate to a explicit user). Since we can do protection via validations (set up lot of validation rules and do lot of validation on context), maybe we can get a smarter way?

Any idea?