# Attr\_accessible & site administrator issue

**URL:** <https://www.ruby-forum.com/t/attr-accessible-site-administrator-issue/147347>\
**Category:** Rails\
**Created:** [August 31, 2008, 7:27pm UTC](https://www.ruby-forum.com/t/attr-accessible-site-administrator-issue/147347 "2008-08-31T19:27:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![chunkyslink](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f0a364/32.png) [@chunkyslink](https://www.ruby-forum.com/u/chunkyslink)\
**Post date:** [August 31, 2008, 7:27pm UTC](https://www.ruby-forum.com/t/attr-accessible-site-administrator-issue/147347/1 "2008-08-31T19:27:41Z")

</div>

I’m working on an app which has a :featured\_at in Users and Groups  
tables. The attribute enables a site admin to set records to a  
:featured\_at datetime. There’s named spaced admin controllers for the  
Users and Groups. The problem is, to set the :featured\_at in the admin  
controllers for users and groups, the attribute had to be exposed under  
attr\_accessible in User.rb and Group.rb. This means we’re open to mass  
assignment hacks on this attribute. Is there a more elegant route to  
avoiding hacks than setting the params[:user][:featured\_at] = nil (same  
for groups) in the public facing controllers for :create and :update  
actions?