Merb::ParamsFilter::ControllerMixin::ClassMethods

Public Instance Methods

log_params_filtered(*args) click to toggle source

Filters parameters out from the default log string

Params will still be passed to the controller properly, they will show up as [FILTERED] in the merb logs.

Parameters

args

Params that will be filtered

Example

  log_params_filtered :password, 'token'

:api: public

    # File lib/merb-param-protection.rb, line 77
77:         def log_params_filtered(*args)
78:           self.log_params_args ||= []
79:           self.log_params_args += args.collect { |arg| arg.to_s }
80:         end
params_accessible(args = {}) click to toggle source

Ensures these parameters are sent for the object

Parameters

args

Params that will be filtered

Example

  # The request sets:
  params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } }

  MyController < Application
    params_accessible :post => [:title, :body]
  end

  params.inspect # => { :post => { :title => "ello", :body => "Want it" } }

So we see that params_accessible removes everything except what is explictly specified.

:api: public

    # File lib/merb-param-protection.rb, line 39
39:         def params_accessible(args = {})
40:           assign_filtered_params(:accessible_params_args, args)
41:         end
params_protected(args = {}) click to toggle source

Protects parameters of an object

Parameters

args

Params that will be filtered

Example

  # The request sets:
  params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } }

  MyController < Application
    params_protected :post => [:status, :author_id]
  end

  params.inspect # => { :post => { :title => "ello", :body => "Want it", :rank => 4 } }

So we see that params_protected removes ONLY those parameters explicitly specified.

:api: public

    # File lib/merb-param-protection.rb, line 61
61:         def params_protected(args = {})
62:           assign_filtered_params(:protected_params_args, args)
63:         end

Private Instance Methods

assign_filtered_params(method, args) click to toggle source
    # File lib/merb-param-protection.rb, line 84
84:         def assign_filtered_params(method, args)
85:           validate_filtered_params(method, args)
86: 
87:           # If the method is nil, set to initial hash, otherwise merge
88:           self.send(method).nil? ? self.send(method.to_s + '=', args) : self.send(method).merge!(args)
89:         end
validate_filtered_params(method, args) click to toggle source
     # File lib/merb-param-protection.rb, line 91
 91:         def validate_filtered_params(method, args)
 92:           # Reversing methods
 93:           params_methods = [:accessible_params_args, :protected_params_args]
 94:           params_methods.delete(method)
 95:           params_method = params_methods.first
 96: 
 97:           # Make sure the opposite method is not nil
 98:           unless self.send(params_method).nil?
 99:             # Loop through arg's keys
100:             args.keys.each do |key|
101:               # If the key exists on the opposite method, raise exception
102:               if self.send(params_method).include?(key)
103:                 case method
104:                 when :accessible_params_args then raise "Cannot make accessible a controller (#{self}) that is already protected"
105:                 when :protected_params_args then raise "Cannot protect controller (#{self}) that is already accessible"
106:                 end
107:               end
108:             end
109:           end
110:         end

Disabled; run with --debug to generate this.

[Validate]

Generated with the Darkfish Rdoc Generator 1.1.6.