Is the solution given in the article any different than using this? config.activ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

Shanewho on March 5, 2012 | parent | context | favorite | on: How Homakov hacked GitHub & the line of code that ...

Is the solution given in the article any different than using this?

config.active_record.whitelist_attributes = true

Also, this isn't the first time someone's been bit by this: http://www.kalzumeus.com/2010/09/22/security-lessons-learned...

petenixey on March 5, 2012 [–]

I didn't know about the solution you mention at the time I wrote the post. I'm reading up on it now and I think it's actually going to end up being the official solution so it's a good flag:

https://github.com/rails/rails/commit/06a3a8a458e70c1b6531ac...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact