cakephp/cakephp — pull request #2524 by markstory (2013-12-22 04:08:21+00:00)
Title: 3.0 safer mass assignment

When I was originally thinking about the mass-assignment protection I thought it should be enabled by default for bulk sets, but disabled when setting single properties. My thinking was:

* Setting a single property will rarely be done from request data, unless you are doing silly things.
* Setting bulk properties from request data should be protected by default. Having safe + secure defaults should be something a framework does for you. Having to opt into secure features using guard = true seems less than ideal to me.

While having bulk sets disabled by default may seem awkward I think it is a safer default given the issues mass-assignment has caused in the rails community. I see bake as a place where we could build some smarts and help people set useful defaults up for accessible properties.