Filters parameters out from the default log string
Params will still be passed to the controller properly, they will show up as [FILTERED] in the merb logs.
args | Params that will be filtered |
log_params_filtered :password, 'token'
:api: public
# File lib/merb-param-protection.rb, line 77 77: def log_params_filtered(*args) 78: self.log_params_args ||= [] 79: self.log_params_args += args.collect { |arg| arg.to_s } 80: end
Ensures these parameters are sent for the object
args | Params that will be filtered |
# The request sets: params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } } MyController < Application params_accessible :post => [:title, :body] end params.inspect # => { :post => { :title => "ello", :body => "Want it" } }
So we see that params_accessible removes everything except what is explictly specified.
:api: public
# File lib/merb-param-protection.rb, line 39 39: def params_accessible(args = {}) 40: assign_filtered_params(:accessible_params_args, args) 41: end
Protects parameters of an object
args | Params that will be filtered |
# The request sets: params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } } MyController < Application params_protected :post => [:status, :author_id] end params.inspect # => { :post => { :title => "ello", :body => "Want it", :rank => 4 } }
So we see that params_protected removes ONLY those parameters explicitly specified.
:api: public
# File lib/merb-param-protection.rb, line 61 61: def params_protected(args = {}) 62: assign_filtered_params(:protected_params_args, args) 63: end
# File lib/merb-param-protection.rb, line 84 84: def assign_filtered_params(method, args) 85: validate_filtered_params(method, args) 86: 87: # If the method is nil, set to initial hash, otherwise merge 88: self.send(method).nil? ? self.send(method.to_s + '=', args) : self.send(method).merge!(args) 89: end
# File lib/merb-param-protection.rb, line 91 91: def validate_filtered_params(method, args) 92: # Reversing methods 93: params_methods = [:accessible_params_args, :protected_params_args] 94: params_methods.delete(method) 95: params_method = params_methods.first 96: 97: # Make sure the opposite method is not nil 98: unless self.send(params_method).nil? 99: # Loop through arg's keys 100: args.keys.each do |key| 101: # If the key exists on the opposite method, raise exception 102: if self.send(params_method).include?(key) 103: case method 104: when :accessible_params_args then raise "Cannot make accessible a controller (#{self}) that is already protected" 105: when :protected_params_args then raise "Cannot protect controller (#{self}) that is already accessible" 106: end 107: end 108: end 109: end 110: end
Disabled; run with --debug to generate this.
Generated with the Darkfish Rdoc Generator 1.1.6.