Received: by 10.52.92.130 with SMTP id cm2mr2696976vdb.2.1336919184533;
        Sun, 13 May 2012 07:26:24 -0700 (PDT)
X-BeenThere: rubyonrails-talk@googlegroups.com
Received: by 10.52.23.142 with SMTP id m14ls71162vdf.1.gmail; Sun, 13 May 2012
 07:25:45 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.52.94.111 with SMTP id db15mr147165vdb.11.1336919145793; Sun,
 13 May 2012 07:25:45 -0700 (PDT)
Authentication-Results: ls.google.com; spf=pass (google.com: domain of
 frederick.che...@gmail.com designates internal as permitted sender)
 smtp.mail=frederick.che...@gmail.com; dkim=pass
 header...@gmail.com
Received: by n33g2000vbi.googlegroups.com with HTTP; Sun, 13 May 2012 07:25:45
 -0700 (PDT)
Date: Sun, 13 May 2012 07:25:45 -0700 (PDT)
In-Reply-To: <CAKwoQDvwfq3v_CoqDiujfr1dT=i-9PDGd8B-7W3pFp+T5-5qvg@mail.gmail.com>
References: <8e60b849-73cf-49f2-8b6a-b1d0092d27cd@f30g2000vbz.googlegroups.com>
 <1025822.14.1336835175876.JavaMail.geo-discussion-forums@pbag9>
 <7efc8d1d-47df-48a0-a4ba-0410fd7b7158@kw17g2000pbb.googlegroups.com> <CAKwoQDvwfq3v_CoqDiujfr1dT=i-9PDGd8B-7W3pFp+T5-5qvg@mail.gmail.com>
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3)
 AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.5 Safari/534.55.3,gzip(gfe)
Message-ID: <c03bf309-4127-4714-a60a-7e75587585d1@n33g2000vbi.googlegroups.com>
Subject: Re: before_save messing up
From: Frederick Cheung <frederick.che...@gmail.com>
To: "Ruby on Rails: Talk" <rubyonrails-talk@googlegroups.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable



On May 13, 9:49=A0am, Yaw Boakye elGran <yawboaky...@gmail.com> wrote:
> attr_accessible describes columns of the db whose values can be set and/o=
r
> modified by the user through the web interface (at least that's what I
> believe). That's my reason for exempting :remember_token from the list. I=
'd
> give it a try and examine the security infringements. If they're not grav=
e,
> I'd stick with your plan.
>
Sort of. it means that the value can be set by update_attributes or
the other APIs that take a hash of attributes. It has no effect on the
ability  to do self.remember_token =3D 'blah'