# How would you suggest ADMIN update non-attr\_accessible fields? **URL:** \ **Category:** Rails\ **Created:** [June 1, 2008, 4:46pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195 "2008-06-01T16:46:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 1, 2008, 4:46pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/1 "2008-06-01T16:46:19Z")
I am using Restful\_Authentication and stumbled upon their use of attr\_accessible in the USER model. When I tried to migrate test USER records into my database and found that any non-attr\_accessible field could not be updated. For those following my previous threads the message in the log was “Can’t mass-assign these protected attributes: field1, field2, etc”. (Thank you Mr. Cheung) I’ve read more about this ActiveRecord method see that it’s wonderful for security reason, BUT how is the ADMIN supposed to update his critical fields that aren’t included in the attr\_accessible list? Thank you, Kathleen ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 1, 2008, 4:58pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/2 "2008-06-01T16:58:57Z")
either by assigning it directly to the object @user.name = “Newname” @user.save or with the singular form update\_attribute @user.update\_attribute(:name, “Newname”) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 1, 2008, 6:00pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/3 "2008-06-01T18:00:18Z")
On Jun 1, 3:58 pm, Thorsten M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > either by assigning it directly to the object > > @user.name = “Newname” > @user.save > > or with the singular form update\_attribute > > @user.update\_attribute(:name, “Newname”) You can also tell activerecord to ignore the attr\_protectedness of things: @user.send :attributes=, some\_params, false Fred ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 1, 2008, 6:46pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/4 "2008-06-01T18:46:46Z")
On Sun, Jun 1, 2008 at 10:45 AM, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I am using Restful\_Authentication and stumbled upon their use of > attr\_accessible in the USER model. When I tried to migrate test USER > records into my database and found that any non-attr\_accessible field > could not be updated. For those following my previous threads the > message in the log was “Can’t mass-assign these protected attributes: > field1, field2, etc”. (Thank you Mr. Cheung) > I’ve read more about this ActiveRecord method see that it’s wonderful > for security reason, BUT how is the ADMIN supposed to update his > critical fields that aren’t included in the attr\_accessible list? By using setter methods. user.field1 = value attr\_protected/attr\_accessible will ignore protected attributes mentioned in a MASS assignment, e.g. user.attributes = {:field1 =\> value, …} or User.create(:field1 =\> value,…) but user.field1 = value will work. – Rick DeNatale My blog on Ruby [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 2, 2008, 5:11am UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/5 "2008-06-02T05:11:57Z")
I am familiar with editing a record using the form\_for and passing the params hash to the update controller action. I must have not explained this clearly…how do we pass the ‘protected’ values to the fields that are non attr\_accessible? Don’t all values going from a view to a controller pass through a params hash? If we can’t pass the values in the params hash, how do we get them to the update controller action? Thank you, Kathleen ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 2, 2008, 2:40pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/6 "2008-06-02T14:40:52Z")
On Sun, Jun 1, 2008 at 11:11 PM, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I am familiar with editing a record using the form\_for and passing the > params hash to the update controller action. > I must have not explained this clearly…how do we pass the > ‘protected’ values to the fields that are non attr\_accessible? > Don’t all values going from a view to a controller pass through a > params hash? If we can’t pass the values in the params hash, how do we > get them to the update controller action? > Thank you, > Kathleen You can’t ‘pass’ a value of a mass assignment protected attribute simply by passing the entire hash. Presumably the attribute is protected because you don’t want to allow any old value to be assigned because someone cooked up an ‘evil’ URL. But you can extract the value from the params hash yourself, examine the value, and either reject or modify it. def post @user = User.new(params[:user]). proposed\_field1\_value = params[:user][:field1] @user.field1 = sanitize(proposed\_field1\_value) # Where sanitize is a controller method which removes any ‘evil’ from the value if @user.save #… else #… end end or a refinement of this, which puts the code in the model where it belongs, is to add a method the model which takes the proposed value and sanitizes, ignores it or possibly raises an error. Maybe something like this ‘sketch’: class User \< ActiveRecord::Base #… def proposed\_field1=(value) # check the value, scrub it if necessary, and if you want to set the value then… self.field1 = scrubbed\_value end end – Rick DeNatale My blog on Ruby [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/) ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [June 2, 2008, 4:13pm UTC](https://www.ruby-forum.com/t/how-would-you-suggest-admin-update-non-attr-accessible-fields/139195/7 "2008-06-02T16:13:19Z")
Rick, Thank you for your kind description of passing a sensitive value inside a hash. I’ve got a boolean value in my USER model that basically unlocks the door for omnipotent privileges. As this is a boolean that only accepts 0 or 1, I cannot envision how this approach would work? Have you ever faced this challenge? Thank you, Kathleen