Skip to content

Commit 45509ee

Browse files
pixeltrixpixeltrix
committed
Pass mass-assignment options to nested models - closes rails#1673.
1 parent 113466c commit 45509ee

File tree

4 files changed

+276
-18
lines changed

4 files changed

+276
-18
lines changed

‎activerecord/lib/active_record/base.rb‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1731,10 +1731,13 @@ def assign_attributes(new_attributes, options = {})
17311731
attributes.each do |k, v|
17321732
if k.include?("(")
17331733
multi_parameter_attributes << [ k, v ]
1734-
elsif respond_to?("#{k}=")
1735-
send("#{k}=", v)
17361734
else
1737-
raise(UnknownAttributeError, "unknown attribute: #{k}")
1735+
method_name = "#{k}="
1736+
if respond_to?(method_name)
1737+
method(method_name).arity == -2 ? send(method_name, v, options) : send(method_name, v)
1738+
else
1739+
raise(UnknownAttributeError, "unknown attribute: #{k}")
1740+
end
17381741
end
17391742
end
17401743

‎activerecord/lib/active_record/nested_attributes.rb‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -276,15 +276,15 @@ def accepts_nested_attributes_for(*attr_names)
276276

277277
type = (reflection.collection? ? :collection : :one_to_one)
278278

279-
# def pirate_attributes=(attributes)
280-
# assign_nested_attributes_for_one_to_one_association(:pirate, attributes)
279+
# def pirate_attributes=(attributes, assignment_opts = {})
280+
# assign_nested_attributes_for_one_to_one_association(:pirate, attributes, assignment_opts)
281281
# end
282282
class_eval <<-eoruby, __FILE__, __LINE__ + 1
283283
if method_defined?(:#{association_name}_attributes=)
284284
remove_method(:#{association_name}_attributes=)
285285
end
286-
def #{association_name}_attributes=(attributes)
287-
assign_nested_attributes_for_#{type}_association(:#{association_name}, attributes)
286+
def #{association_name}_attributes=(attributes, assignment_opts = {})
287+
assign_nested_attributes_for_#{type}_association(:#{association_name}, attributes, assignment_opts)
288288
end
289289
eoruby
290290
else
@@ -319,21 +319,21 @@ def _destroy
319319
# If the given attributes include a matching <tt>:id</tt> attribute, or
320320
# update_only is true, and a <tt>:_destroy</tt> key set to a truthy value,
321321
# then the existing record will be marked for destruction.
322-
def assign_nested_attributes_for_one_to_one_association(association_name, attributes)
322+
def assign_nested_attributes_for_one_to_one_association(association_name, attributes, assignment_opts = {})
323323
options = self.nested_attributes_options[association_name]
324324
attributes = attributes.with_indifferent_access
325325

326326
if (options[:update_only] || !attributes['id'].blank?) && (record = send(association_name)) &&
327327
(options[:update_only] || record.id.to_s == attributes['id'].to_s)
328-
assign_to_or_mark_for_destruction(record, attributes, options[:allow_destroy]) unless call_reject_if(association_name, attributes)
328+
assign_to_or_mark_for_destruction(record, attributes, options[:allow_destroy], assignment_opts) unless call_reject_if(association_name, attributes)
329329

330-
elsif attributes['id'].present?
330+
elsif attributes['id'].present? && !assignment_opts[:without_protection]
331331
raise_nested_attributes_record_not_found(association_name, attributes['id'])
332332

333333
elsif !reject_new_record?(association_name, attributes)
334334
method = "build_#{association_name}"
335335
if respond_to?(method)
336-
send(method, attributes.except(*UNASSIGNABLE_KEYS))
336+
send(method, attributes.except(*unassignable_keys(assignment_opts)), assignment_opts)
337337
else
338338
raise ArgumentError, "Cannot build association #{association_name}. Are you trying to build a polymorphic one-to-one association?"
339339
end
@@ -367,7 +367,7 @@ def assign_nested_attributes_for_one_to_one_association(association_name, attrib
367367
# { :name => 'John' },
368368
# { :id => '2', :_destroy => true }
369369
# ])
370-
def assign_nested_attributes_for_collection_association(association_name, attributes_collection)
370+
def assign_nested_attributes_for_collection_association(association_name, attributes_collection, assignment_opts = {})
371371
options = self.nested_attributes_options[association_name]
372372

373373
unless attributes_collection.is_a?(Hash) || attributes_collection.is_a?(Array)
@@ -401,7 +401,7 @@ def assign_nested_attributes_for_collection_association(association_name, attrib
401401

402402
if attributes['id'].blank?
403403
unless reject_new_record?(association_name, attributes)
404-
association.build(attributes.except(*UNASSIGNABLE_KEYS))
404+
association.build(attributes.except(*unassignable_keys(assignment_opts)), assignment_opts)
405405
end
406406
elsif existing_record = existing_records.detect { |record| record.id.to_s == attributes['id'].to_s }
407407
unless association.loaded? || call_reject_if(association_name, attributes)
@@ -418,8 +418,10 @@ def assign_nested_attributes_for_collection_association(association_name, attrib
418418
end
419419

420420
if !call_reject_if(association_name, attributes)
421-
assign_to_or_mark_for_destruction(existing_record, attributes, options[:allow_destroy])
421+
assign_to_or_mark_for_destruction(existing_record, attributes, options[:allow_destroy], assignment_opts)
422422
end
423+
elsif assignment_opts[:without_protection]
424+
association.build(attributes.except(*unassignable_keys(assignment_opts)), assignment_opts)
423425
else
424426
raise_nested_attributes_record_not_found(association_name, attributes['id'])
425427
end
@@ -428,8 +430,8 @@ def assign_nested_attributes_for_collection_association(association_name, attrib
428430

429431
# Updates a record with the +attributes+ or marks it for destruction if
430432
# +allow_destroy+ is +true+ and has_destroy_flag? returns +true+.
431-
def assign_to_or_mark_for_destruction(record, attributes, allow_destroy)
432-
record.attributes = attributes.except(*UNASSIGNABLE_KEYS)
433+
def assign_to_or_mark_for_destruction(record, attributes, allow_destroy, assignment_opts)
434+
record.assign_attributes(attributes.except(*unassignable_keys(assignment_opts)), assignment_opts)
433435
record.mark_for_destruction if has_destroy_flag?(attributes) && allow_destroy
434436
end
435437

@@ -458,5 +460,9 @@ def call_reject_if(association_name, attributes)
458460
def raise_nested_attributes_record_not_found(association_name, record_id)
459461
raise RecordNotFound, "Couldn't find #{self.class.reflect_on_association(association_name).klass.name} with ID=#{record_id} for #{self.class.name} with ID=#{id}"
460462
end
463+
464+
def unassignable_keys(assignment_opts)
465+
assignment_opts[:without_protection] ? UNASSIGNABLE_KEYS - %w[id] : UNASSIGNABLE_KEYS
466+
end
461467
end
462468
end

‎activerecord/test/cases/mass_assignment_security_test.rb‎

Lines changed: 245 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -552,3 +552,248 @@ def test_has_many_create_with_bang_without_protection
552552
end
553553

554554
end
555+
556+
557+
class MassAssignmentSecurityNestedAttributesTest < ActiveRecord::TestCase
558+
include MassAssignmentTestHelpers
559+
560+
def nested_attributes_hash(association, collection = false, except = [:id])
561+
if collection
562+
{ :first_name => 'David' }.merge(:"#{association}_attributes" => [attributes_hash.except(*except)])
563+
else
564+
{ :first_name => 'David' }.merge(:"#{association}_attributes" => attributes_hash.except(*except))
565+
end
566+
end
567+
568+
# build
569+
570+
def test_has_one_new_with_attr_protected_attributes
571+
person = LoosePerson.new(nested_attributes_hash(:best_friend))
572+
assert_default_attributes(person.best_friend)
573+
end
574+
575+
def test_has_one_new_with_attr_accessible_attributes
576+
person = TightPerson.new(nested_attributes_hash(:best_friend))
577+
assert_default_attributes(person.best_friend)
578+
end
579+
580+
def test_has_one_new_with_admin_role_with_attr_protected_attributes
581+
person = LoosePerson.new(nested_attributes_hash(:best_friend), :as => :admin)
582+
assert_admin_attributes(person.best_friend)
583+
end
584+
585+
def test_has_one_new_with_admin_role_with_attr_accessible_attributes
586+
person = TightPerson.new(nested_attributes_hash(:best_friend), :as => :admin)
587+
assert_admin_attributes(person.best_friend)
588+
end
589+
590+
def test_has_one_new_without_protection
591+
person = LoosePerson.new(nested_attributes_hash(:best_friend, false, nil), :without_protection => true)
592+
assert_all_attributes(person.best_friend)
593+
end
594+
595+
def test_belongs_to_new_with_attr_protected_attributes
596+
person = LoosePerson.new(nested_attributes_hash(:best_friend_of))
597+
assert_default_attributes(person.best_friend_of)
598+
end
599+
600+
def test_belongs_to_new_with_attr_accessible_attributes
601+
person = TightPerson.new(nested_attributes_hash(:best_friend_of))
602+
assert_default_attributes(person.best_friend_of)
603+
end
604+
605+
def test_belongs_to_new_with_admin_role_with_attr_protected_attributes
606+
person = LoosePerson.new(nested_attributes_hash(:best_friend_of), :as => :admin)
607+
assert_admin_attributes(person.best_friend_of)
608+
end
609+
610+
def test_belongs_to_new_with_admin_role_with_attr_accessible_attributes
611+
person = TightPerson.new(nested_attributes_hash(:best_friend_of), :as => :admin)
612+
assert_admin_attributes(person.best_friend_of)
613+
end
614+
615+
def test_belongs_to_new_without_protection
616+
person = LoosePerson.new(nested_attributes_hash(:best_friend_of, false, nil), :without_protection => true)
617+
assert_all_attributes(person.best_friend_of)
618+
end
619+
620+
def test_has_many_new_with_attr_protected_attributes
621+
person = LoosePerson.new(nested_attributes_hash(:best_friends, true))
622+
assert_default_attributes(person.best_friends.first)
623+
end
624+
625+
def test_has_many_new_with_attr_accessible_attributes
626+
person = TightPerson.new(nested_attributes_hash(:best_friends, true))
627+
assert_default_attributes(person.best_friends.first)
628+
end
629+
630+
def test_has_many_new_with_admin_role_with_attr_protected_attributes
631+
person = LoosePerson.new(nested_attributes_hash(:best_friends, true), :as => :admin)
632+
assert_admin_attributes(person.best_friends.first)
633+
end
634+
635+
def test_has_many_new_with_admin_role_with_attr_accessible_attributes
636+
person = TightPerson.new(nested_attributes_hash(:best_friends, true), :as => :admin)
637+
assert_admin_attributes(person.best_friends.first)
638+
end
639+
640+
def test_has_many_new_without_protection
641+
person = LoosePerson.new(nested_attributes_hash(:best_friends, true, nil), :without_protection => true)
642+
assert_all_attributes(person.best_friends.first)
643+
end
644+
645+
# create
646+
647+
def test_has_one_create_with_attr_protected_attributes
648+
person = LoosePerson.create(nested_attributes_hash(:best_friend))
649+
assert_default_attributes(person.best_friend, true)
650+
end
651+
652+
def test_has_one_create_with_attr_accessible_attributes
653+
person = TightPerson.create(nested_attributes_hash(:best_friend))
654+
assert_default_attributes(person.best_friend, true)
655+
end
656+
657+
def test_has_one_create_with_admin_role_with_attr_protected_attributes
658+
person = LoosePerson.create(nested_attributes_hash(:best_friend), :as => :admin)
659+
assert_admin_attributes(person.best_friend, true)
660+
end
661+
662+
def test_has_one_create_with_admin_role_with_attr_accessible_attributes
663+
person = TightPerson.create(nested_attributes_hash(:best_friend), :as => :admin)
664+
assert_admin_attributes(person.best_friend, true)
665+
end
666+
667+
def test_has_one_create_without_protection
668+
person = LoosePerson.create(nested_attributes_hash(:best_friend, false, nil), :without_protection => true)
669+
assert_all_attributes(person.best_friend)
670+
end
671+
672+
def test_belongs_to_create_with_attr_protected_attributes
673+
person = LoosePerson.create(nested_attributes_hash(:best_friend_of))
674+
assert_default_attributes(person.best_friend_of, true)
675+
end
676+
677+
def test_belongs_to_create_with_attr_accessible_attributes
678+
person = TightPerson.create(nested_attributes_hash(:best_friend_of))
679+
assert_default_attributes(person.best_friend_of, true)
680+
end
681+
682+
def test_belongs_to_create_with_admin_role_with_attr_protected_attributes
683+
person = LoosePerson.create(nested_attributes_hash(:best_friend_of), :as => :admin)
684+
assert_admin_attributes(person.best_friend_of, true)
685+
end
686+
687+
def test_belongs_to_create_with_admin_role_with_attr_accessible_attributes
688+
person = TightPerson.create(nested_attributes_hash(:best_friend_of), :as => :admin)
689+
assert_admin_attributes(person.best_friend_of, true)
690+
end
691+
692+
def test_belongs_to_create_without_protection
693+
person = LoosePerson.create(nested_attributes_hash(:best_friend_of, false, nil), :without_protection => true)
694+
assert_all_attributes(person.best_friend_of)
695+
end
696+
697+
def test_has_many_create_with_attr_protected_attributes
698+
person = LoosePerson.create(nested_attributes_hash(:best_friends, true))
699+
assert_default_attributes(person.best_friends.first, true)
700+
end
701+
702+
def test_has_many_create_with_attr_accessible_attributes
703+
person = TightPerson.create(nested_attributes_hash(:best_friends, true))
704+
assert_default_attributes(person.best_friends.first, true)
705+
end
706+
707+
def test_has_many_create_with_admin_role_with_attr_protected_attributes
708+
person = LoosePerson.create(nested_attributes_hash(:best_friends, true), :as => :admin)
709+
assert_admin_attributes(person.best_friends.first, true)
710+
end
711+
712+
def test_has_many_create_with_admin_role_with_attr_accessible_attributes
713+
person = TightPerson.create(nested_attributes_hash(:best_friends, true), :as => :admin)
714+
assert_admin_attributes(person.best_friends.first, true)
715+
end
716+
717+
def test_has_many_create_without_protection
718+
person = LoosePerson.create(nested_attributes_hash(:best_friends, true, nil), :without_protection => true)
719+
assert_all_attributes(person.best_friends.first)
720+
end
721+
722+
# create!
723+
724+
def test_has_one_create_with_bang_with_attr_protected_attributes
725+
person = LoosePerson.create!(nested_attributes_hash(:best_friend))
726+
assert_default_attributes(person.best_friend, true)
727+
end
728+
729+
def test_has_one_create_with_bang_with_attr_accessible_attributes
730+
person = TightPerson.create!(nested_attributes_hash(:best_friend))
731+
assert_default_attributes(person.best_friend, true)
732+
end
733+
734+
def test_has_one_create_with_bang_with_admin_role_with_attr_protected_attributes
735+
person = LoosePerson.create!(nested_attributes_hash(:best_friend), :as => :admin)
736+
assert_admin_attributes(person.best_friend, true)
737+
end
738+
739+
def test_has_one_create_with_bang_with_admin_role_with_attr_accessible_attributes
740+
person = TightPerson.create!(nested_attributes_hash(:best_friend), :as => :admin)
741+
assert_admin_attributes(person.best_friend, true)
742+
end
743+
744+
def test_has_one_create_with_bang_without_protection
745+
person = LoosePerson.create!(nested_attributes_hash(:best_friend, false, nil), :without_protection => true)
746+
assert_all_attributes(person.best_friend)
747+
end
748+
749+
def test_belongs_to_create_with_bang_with_attr_protected_attributes
750+
person = LoosePerson.create!(nested_attributes_hash(:best_friend_of))
751+
assert_default_attributes(person.best_friend_of, true)
752+
end
753+
754+
def test_belongs_to_create_with_bang_with_attr_accessible_attributes
755+
person = TightPerson.create!(nested_attributes_hash(:best_friend_of))
756+
assert_default_attributes(person.best_friend_of, true)
757+
end
758+
759+
def test_belongs_to_create_with_bang_with_admin_role_with_attr_protected_attributes
760+
person = LoosePerson.create!(nested_attributes_hash(:best_friend_of), :as => :admin)
761+
assert_admin_attributes(person.best_friend_of, true)
762+
end
763+
764+
def test_belongs_to_create_with_bang_with_admin_role_with_attr_accessible_attributes
765+
person = TightPerson.create!(nested_attributes_hash(:best_friend_of), :as => :admin)
766+
assert_admin_attributes(person.best_friend_of, true)
767+
end
768+
769+
def test_belongs_to_create_with_bang_without_protection
770+
person = LoosePerson.create!(nested_attributes_hash(:best_friend_of, false, nil), :without_protection => true)
771+
assert_all_attributes(person.best_friend_of)
772+
end
773+
774+
def test_has_many_create_with_bang_with_attr_protected_attributes
775+
person = LoosePerson.create!(nested_attributes_hash(:best_friends, true))
776+
assert_default_attributes(person.best_friends.first, true)
777+
end
778+
779+
def test_has_many_create_with_bang_with_attr_accessible_attributes
780+
person = TightPerson.create!(nested_attributes_hash(:best_friends, true))
781+
assert_default_attributes(person.best_friends.first, true)
782+
end
783+
784+
def test_has_many_create_with_bang_with_admin_role_with_attr_protected_attributes
785+
person = LoosePerson.create!(nested_attributes_hash(:best_friends, true), :as => :admin)
786+
assert_admin_attributes(person.best_friends.first, true)
787+
end
788+
789+
def test_has_many_create_with_bang_with_admin_role_with_attr_accessible_attributes
790+
person = TightPerson.create!(nested_attributes_hash(:best_friends, true), :as => :admin)
791+
assert_admin_attributes(person.best_friends.first, true)
792+
end
793+
794+
def test_has_many_create_with_bang_without_protection
795+
person = LoosePerson.create!(nested_attributes_hash(:best_friends, true, nil), :without_protection => true)
796+
assert_all_attributes(person.best_friends.first)
797+
end
798+
799+
end

‎activerecord/test/models/person.rb‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,9 @@ class LoosePerson < ActiveRecord::Base
5959

6060
has_one :best_friend, :class_name => 'LoosePerson', :foreign_key => :best_friend_id
6161
belongs_to :best_friend_of, :class_name => 'LoosePerson', :foreign_key => :best_friend_of_id
62-
6362
has_many :best_friends, :class_name => 'LoosePerson', :foreign_key => :best_friend_id
63+
64+
accepts_nested_attributes_for :best_friend, :best_friend_of, :best_friends
6465
end
6566

6667
class LooseDescendant < LoosePerson; end
@@ -70,11 +71,14 @@ class TightPerson < ActiveRecord::Base
7071

7172
attr_accessible :first_name, :gender
7273
attr_accessible :first_name, :gender, :comments, :as => :admin
74+
attr_accessible :best_friend_attributes, :best_friend_of_attributes, :best_friends_attributes
75+
attr_accessible :best_friend_attributes, :best_friend_of_attributes, :best_friends_attributes, :as => :admin
7376

7477
has_one :best_friend, :class_name => 'TightPerson', :foreign_key => :best_friend_id
7578
belongs_to :best_friend_of, :class_name => 'TightPerson', :foreign_key => :best_friend_of_id
76-
7779
has_many :best_friends, :class_name => 'TightPerson', :foreign_key => :best_friend_id
80+
81+
accepts_nested_attributes_for :best_friend, :best_friend_of, :best_friends
7882
end
7983

8084
class TightDescendant < TightPerson; end

0 commit comments

Comments
 (0)