Search code examples
rubysinatramass-assignmentruby-datamapperattr-accessible

How should I protect mass-assignment in Sinatra app with Datamapper?

I have Link model in Sinatra app

class Link
  include DataMapper::Resource
  has n, :views

  validates_presence_of :url,
    message: "You must specify a URL."
  validates_length_of   :url,
    maximum: 4096,
    allow_blank: true,
    message: "That URL is too long."
  validates_format_of :url,
    with: %r{^(https?|ftp)://.+}i,
    allow_blank: true,
    message: "The URL must start with http://, https://, or ftp:// ."

  property :id,         Serial
  property :url,        String
  property :token,      String
  property :created_at, DateTime
end

How to set up something like attr_accessible :url, :token?

Solution

  • You may use the DataMapper::MassAssignmentSecurity module from the gem dm-rails.

    class Link

  include DataMapper::Resource
  include DataMapper::MassAssignmentSecurity
  attr_accessible :url, :token

  # ...

end