module Merb::ParamsFilter::ControllerMixin::ClassMethods

Public Instance Methods

log_params_filtered(*args) click to toggle source

Filters parameters out from the default log string

Params will still be passed to the controller properly, they will show up as [FILTERED] in the merb logs.

Parameters

args

Params that will be filtered

Example

log_params_filtered :password, 'token'

:api: public

# File lib/merb-param-protection.rb, line 77
def log_params_filtered(*args)
  self.log_params_args ||= []
  self.log_params_args += args.collect { |arg| arg.to_s }
end
params_accessible(args = {}) click to toggle source

Ensures these parameters are sent for the object

Parameters

args

Params that will be filtered

Example

# The request sets:
params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } }

MyController < Application
  params_accessible :post => [:title, :body]
end

params.inspect # => { :post => { :title => "ello", :body => "Want it" } }

So we see that #params_accessible removes everything except what is explictly specified.

:api: public

# File lib/merb-param-protection.rb, line 39
def params_accessible(args = {})
  assign_filtered_params(:accessible_params_args, args)
end
params_protected(args = {}) click to toggle source

Protects parameters of an object

Parameters

args

Params that will be filtered

Example

# The request sets:
params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } }

MyController < Application
  params_protected :post => [:status, :author_id]
end

params.inspect # => { :post => { :title => "ello", :body => "Want it", :rank => 4 } }

So we see that #params_protected removes ONLY those parameters explicitly specified.

:api: public

# File lib/merb-param-protection.rb, line 61
def params_protected(args = {})
  assign_filtered_params(:protected_params_args, args)
end

Private Instance Methods

assign_filtered_params(method, args) click to toggle source
# File lib/merb-param-protection.rb, line 84
def assign_filtered_params(method, args)
  validate_filtered_params(method, args)

  # If the method is nil, set to initial hash, otherwise merge
  self.send(method).nil? ? self.send(method.to_s + '=', args) : self.send(method).merge!(args)
end
validate_filtered_params(method, args) click to toggle source
# File lib/merb-param-protection.rb, line 91
def validate_filtered_params(method, args)
  # Reversing methods
  params_methods = [:accessible_params_args, :protected_params_args]
  params_methods.delete(method)
  params_method = params_methods.first

  # Make sure the opposite method is not nil
  unless self.send(params_method).nil?
    # Loop through arg's keys
    args.keys.each do |key|
      # If the key exists on the opposite method, raise exception
      if self.send(params_method).include?(key)
        case method
        when :accessible_params_args then raise "Cannot make accessible a controller (#{self}) that is already protected"
        when :protected_params_args then raise "Cannot protect controller (#{self}) that is already accessible"
        end
      end
    end
  end
end