views:

63

answers:

3

I don't know if the term "mass assignment" is Rails-specific but I get the basic idea that mass assignment is when you assign values to a bunch of variables all in the same method.

Is that a correct definition and why is there a special name for this?

+1  A: 

Some of the default behavior of ActiveRecord is prone to vulnerability. Specifically, updating attributes automatically from user submitted forms mass updating can expose vulnerabilities. My guess is that the term mass updating has been popularized as a handle to discuss both the conveniences and vulnerabilities of this ActiveRecord feature.

jrhicks
+4  A: 

Mass assignment in Rails is when you use something like User.new(:name => "David", :occupation => "Code Artist") to set all of the values for a row at once. The danger comes in when you change this code to be more like User.new(params[:user]). Now it's possible for an end user to maliciously craft the Hash that is passed in as a parameter to User.new and set variables you weren't expecting. Hence the need for attr_accessible and attr_protected, which limit an end user's ability to set fields that they shouldn't be able to affect directly.

Bob Aman
A: 

Basically, without mass assignment, you would create a model like this:

user = User.new
user.first_name = params[:user][:first_name]
user.last_name = params[:user][:last_name]

With mass assignment the model itself will figure out to call those setters and all you need to do is

user = User.new(params[:user])

So yes, it is - kind of - setting a lot of variables with one method.

Jongsma