Mass assignment
1. Controller is not aware of our business logic and that’s a good thing.
Project.new(params[:project])
2. Initializing objects using hashes is convenient. Also, DataMapper uses it internally to initialize associations.
Project.new(:any => :param, :goes => :here)
3. Some params are special and are not allowed to be manipulated by user.
Project.new(params[:project].reject{|k,v|
k.to_s =~ /^id|owner(_id)?$/
})
4. Some params are not so special, but are accessible by specific user groups.
@project.update_attributes(params[:project].reject{|k,v|
k.to_s =~ /^owner(_id)?$/ &&
@project.owner != current_person
})
5. While models maintain consistent state of the system (key uniqueness, correct data formats and relationships), controllers maintain control flow (hence the name) along with authentication and authorization.
6. Therefore, currently used mass assignment protection implementations do not solve the problem. attr_accessible/attr_protected methods in ActiveRecord get in your way. A plugin for DataMapper I wrote yesterday also doesn’t help.
7. The right solution is a mix-in module for controllers with before filters, which should safely instantiate all necessary models.