blocks|key|215291|text|Mass+Assignment是Rails赋予使用参数散列构造对象的行为的名称。它是“批量赋值”，因为您通过单个赋值操作符将多个值赋值给属性。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|215292|以下代码段对Post模型的name和topic属性执行批量赋值：|style|CODE|215293|Post.new(:name+=>+"John",+:topic+=>+"Something")
Post.create(:name+=>+"John",+:topic+=>+"Something")
Post.update_attributes(:name+=>+"John",+:topic+=>+"Something")|code-block|syntax|javascript|215294|为了实现这一点，您的模型必须允许对您传递的散列中的每个属性进行批量赋值。|215295|在以下两种情况下，此操作将失败：|215296|215297|您有一个不包含:name|unordered-list-item|215298|You的attr_accessible声明，一个包含:name|215299|的attr_protected|215300|最近，为了使批量分配成功，必须通过attr_accessible手动将属性列入白名单，这已成为默认做法。在此之前，默认情况下属性是可分配的，除非它们显式地被列入黑名单attr_protected，或者任何其他属性被attr_acessible.列入白名单|215301|重要的是要考虑哪些属性可以被批量赋值，因为这样的代码非常常见：|215302|@post+=+Post.new(params[:post])|215303|通常，这在用户提交由form_for+@post呈现的表单时使用。在理想情况下，params[:post]散列应该只包含我们在表单上显示的字段。但是，用户很容易在请求中传递额外的字段，因此实际上您允许用户在@post上设置任何字段，而不仅仅是表单上显示的字段。|215304|未能安全地使用批量赋值已经在一些大型Rails应用程序中导致了几个备受关注的错误，比如允许某人inject+their+own+public+key到Github存储库的可信密钥列表中，并将代码直接推送到他们不应该访问的存储库。|215305|entityMap|0|LINK|mutability|MUTABLE|url|http://guides.rubyonrails.org/security.html#mass-assignment|1|http://www.infoq.com/news/2012/03/GitHub-Compromised/^0|0|F|0|0|6|4|D|4|I|5|0|0|0|0|0|7|5|0|4|F|Q|5|0|1|E|0|H|F|2B|E|2Z|F|0|0|0|A|E|14|D|2V|5|0|1B|R|1|0^^$0|@$1|2|3|4|5|6|7|1I|8|@]|9|@$A|1J|B|1K|1|1L]]|C|$]]|$1|D|3|E|5|6|7|1M|8|@$A|1N|B|1O|F|G]|$A|1P|B|1Q|F|G]|$A|1R|B|1S|F|G]]|9|@]|C|$]]|$1|H|3|I|5|J|7|1T|8|@]|9|@]|C|$K|L]]|$1|M|3|N|5|6|7|1U|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1V|8|@]|9|@]|C|$]]|$1|Q|3|-4|5|6|7|1W|8|@]|9|@]|C|$]]|$1|R|3|S|5|T|7|1X|8|@$A|1Y|B|1Z|F|G]]|9|@]|C|$]]|$1|U|3|V|5|T|7|20|8|@$A|21|B|22|F|G]|$A|23|B|24|F|G]]|9|@]|C|$]]|$1|W|3|X|5|6|7|25|8|@$A|26|B|27|F|G]]|9|@]|C|$]]|$1|Y|3|Z|5|6|7|28|8|@$A|29|B|2A|F|G]|$A|2B|B|2C|F|G]|$A|2D|B|2E|F|G]]|9|@]|C|$]]|$1|10|3|11|5|6|7|2F|8|@]|9|@]|C|$]]|$1|12|3|13|5|J|7|2G|8|@]|9|@]|C|$K|L]]|$1|14|3|15|5|6|7|2H|8|@$A|2I|B|2J|F|G]|$A|2K|B|2L|F|G]|$A|2M|B|2N|F|G]]|9|@]|C|$]]|$1|16|3|17|5|6|7|2O|8|@]|9|@$A|2P|B|2Q|1|2R]]|C|$]]|$1|18|3|-4|5|6|7|2S|8|@]|9|@]|C|$]]]|19|$1A|$5|1B|1C|1D|C|$1E|1F]]|1G|$5|1B|1C|1D|C|$1E|1H]]]]

<a href="http://guides.rubyonrails.org/security.html#mass-assignment">Mass Assignment</a> is the name Rails gives to the act of constructing your object with a parameters hash. It is "mass assignment" in that you are assigning multiple values to attributes via a single assignment operator.

The following snippets perform mass assignment of the <code>name</code> and <code>topic</code> attribute of the <code>Post</code> model:

<pre><code>Post.new(:name =&gt; "John", :topic =&gt; "Something")
Post.create(:name =&gt; "John", :topic =&gt; "Something")
Post.update_attributes(:name =&gt; "John", :topic =&gt; "Something")
</code></pre>

In order for this to work, your model must allow mass assignments for each attribute in the hash you're passing in.

There are two situations in which this will fail:

<ul>
<li>You have an <code>attr_accessible</code> declaration which does not include <code>:name</code></li>
<li>You have an <code>attr_protected</code> which does include <code>:name</code></li>
</ul>

It recently became the default that attributes had to be manually white-listed via a <code>attr_accessible</code> in order for mass assignment to succeed. Prior to this, the default was for attributes to be assignable unless they were explicitly black-listed <code>attr_protected</code> or any other attribute was white-listed with <code>attr_acessible.</code>

It is important to consider which attributes can be mass assigned because code like this is so common:

<pre><code>@post = Post.new(params[:post])
</code></pre>

Typically this is used when the user submits a form rendered by a <code>form_for @post</code>. In an ideal world, the <code>params[:post]</code> hash should only contain the fields we displayed on the form. However, it is trivial easy for the user to pass additional fields in their request, so in effect you're allowing a user to set any fields on <code>@post</code>, not just the ones displayed on the form.

Failure to safely use mass assignment has led to several high profile bugs in some pretty big Rails applications, like the one that allowed somebody to <a href="http://www.infoq.com/news/2012/03/GitHub-Compromised/">inject their own public key</a> into the list of trusted keys on a Github repository and push code directly to a repository they should not have had access to.

I have heard couple of people complaining and posting questions about mass-assignment in Rails. I have got same error couple of times and all I did was <code>attr_accessible</code>. But what exactly is mass assignment? could somebody explain with example?

What is mass-assignment in Rails 3

我听说有几个人抱怨并发布了关于Rails中的批量分配的问题。我收到了几次相同的错误，我所做的一切都是attr_accessible。但是，什么是批量分配呢？有没有人能举例说明一下？

问什么是Rails 3中的质量分配？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问什么是Rails 3中的质量分配？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问什么是Rails 3中的质量分配？
EN