Rails 4 StrongAttributes in RailsCast #274

Question

I am new to Rails. Particularly in dealing with the vagaries between Rails 3 and 4. I have been learning from RailsCast and MHartl's tutorial.

I successfully got the code in RailsCast #274 to work by using the answer in the question linked below: ActiveModel::ForbiddenAttributesError in PasswordResetsController#update

My concern is that this fix will leave me vulnerable to issues in the future, be it security or otherwise. If there is a "right" way to do this I would like to know. Here is my code block:

class PasswordResetsController < ApplicationController
  def create
    user = User.find_by_email(params[:email])
    user.send_password_reset if user
    redirect_to root_url, :notice => "Email sent with password reset instructions."
  end

  def edit
    @user = User.find_by_password_reset_token!(params[:id])
  end

  def update
    @user = User.find_by_password_reset_token!(params[:id])
    if @user.password_reset_sent_at < 2.hours.ago
      redirect_to new_password_reset_path, :alert => "Password reset has expired."
    elsif @user.update_attributes(params.require(:user).permit(:password, :password_confirmation))
      redirect_to root_url, :notice => "Password has been reset."
    else
      render :edit
    end
  end
end

Answer 1

you need to setup your params first. define a private method inside your class

private
def model_params
  params.require(:model).permit(:list :all :your :attributes)
end

then when you do an update, use something like:

@model.update(model_params)

mass assignment is a cool thing in rails, but you need to make sure you are protected

hope that helps