railsbp/rails_best_practices — pull request #108 by harigopal (2012-03-20 12:17:45+00:00)
Title: attr_accessible can be specified without arguments to block all 

As per this thread...

http://stackoverflow.com/questions/4838399/how-i-can-set-attr-accessible-in-order-to-not-allow-access-to-any-of-the-field

... it is possible to use `attr_accessible` without any arguments to blanket ban mass assignment for a model. However, _rails_best_practices_ seems to ignore this use case, and raises a "protect mass assignment" warning when `attr_accessible` gets called without arguments.

I'm extremely unfamiliar with the codebase, so I copied the implementation of rspec test and check for _authlogic without configuration_, and that seems to work. It would be great if you could verify my changes.

As an alternative, I'd tried setting...

```ruby
config.active_record.whitelist_attributes = true
```

... which seems to be the best way to block mass assignment altogether, as mentioned at rails-bestpractices.com, but the gem seems not to take that into account when checking for _mass assignment protection_, i.e, for models which completely disallow mass assignment.