Ruby on Rails: What prevents a user from adding a form field to a form?
ruby, ruby-on-rails
Solution
This is the why of the existence of two very useful ActiveRecord class methods:
- attr_protected
- attr_accesible
Check the documentation about MassAssignment to understand it better.
Problem
If I have a form in Rails, and I only want to expose certain fields to the user, how do I prevent the user from hacking the form and adding additional fields to insert unwanted data? For example, say I have a task.rb model with the following columns: name, description, internal_notes. For the public form in "app/views/tasks/new.html.erb", I only want to expose the public fields like so: ``` form name: description: /form ``` How can I prevent the user from hacking the form and doing this: ``` form name: description: internal_notes: <--- inserted by user (e.g. through Google Chrome Elements) /form ``` For example, the user can enter `<input type="text" name="task[internal_notes]" />` into the form, and submit the unwanted data. Is there a way to prevent that?