rails/rails — pull request #5813 by diminish7 (2012-04-11 18:59:50+00:00)
Title: Allow the building of STI associations

When building an active record object from an association with parent.children.build, parent.build_child, or the equivalent with nested form attributes, this change allows you to pass the inheritance column attribute to specify the subclass when the associated class uses STI. e.g.

parent.children.build(:type => "OldestChild")

This has been the subject of a few other pull requests/issues, and has been closed out for security reasons. I believe this patch addresses those security issues by

1. Ensuring that the class name is a valid class and that it is in the ancestors of the super class that the association is expecting. You cannot build any random object, it must be in the base association class's hierarchy.

2. Respecting protected attributes. By default the inheritance column is protected. In order to build an association using a subclass, the inheritance column must be explicitly made accessible, either by overriding attributes_protected_by_default, or with attr_accessible.

Here are the previously closed issues for reference:
* https://github.com/rails/rails/pull/1686
* https://github.com/rails/rails/issues/3749
* https://github.com/rails/rails/pull/3750
* https://github.com/rails/rails/issues/4130