# In\_place\_editor & security

**URL:** <https://www.ruby-forum.com/t/in-place-editor-security/134954>\
**Category:** Rails\
**Created:** [April 16, 2008, 3:57pm UTC](https://www.ruby-forum.com/t/in-place-editor-security/134954 "2008-04-16T15:57:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![thorsten](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/d2c977/32.png) [@thorsten](https://www.ruby-forum.com/u/thorsten)\
**Post date:** [April 16, 2008, 3:57pm UTC](https://www.ruby-forum.com/t/in-place-editor-security/134954/1 "2008-04-16T15:57:46Z")

</div>

I’m refactoring an app that uses in\_place\_edit\_for

the controller code looks like:

Address.content\_columns.each do |column|  
in\_place\_edit\_for :address, column.name  
end

new Ajax.InPlaceEditor(‘address\_street\_1234\_in\_place\_editor’,  
‘/customer/product/set\_address\_street/1234’)

since there’s no set\_address\_street method in the controller, i guess  
the in\_place\_edit\_for generates it.

But that would mean, that the controller would accept any call with any  
id and update the fields? (Even if I check for login with a before  
filter, a logged in user could change other users data)

So the questions:

- Am I right about the security issue here or do I miss something?  
(didn’t read too much docs now)
- Can I write my own methods and make in\_place\_edit\_for use them? (Even  
if this would mean to write one method per attribute)
- Or is there an alternative plugin that handles this better?

---

<div class="post-metadata">

**Author:** ![thorsten](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/d2c977/32.png) [@thorsten](https://www.ruby-forum.com/u/thorsten)\
**Post date:** [April 16, 2008, 4:05pm UTC](https://www.ruby-forum.com/t/in-place-editor-security/134954/2 "2008-04-16T16:05:18Z")

</div>

On 16 Apr 2008, at 14:57, Thorsten M. wrote:

> ‘/customer/product/set\_address\_street/1234’)
> 
> - Am I right about the security issue here or do I miss something?  
> (didn’t read too much docs now)
> - Can I write my own methods and make in\_place\_edit\_for use them?  
> (Even  
> if this would mean to write one method per attribute)

in\_place\_edit\_for in the controller is just shorthand for the most  
common case. it doesn’t do anything clever, if you look at the source  
it’s just:

```
 def in_place_edit_for(object, attribute, options = {})
   define_method("set_#{object}_#{attribute}") do
     @item = object.to_s.camelize.constantize.find(params[:id])
     @item.update_attribute(attribute, params[:value])
     render :text => @item.send(attribute).to_s
   end
 end

```

All you need to do is create methods with the appropriate name, which  
you could do by hand or roll your own version of in\_place\_edit\_for  
which checked whatever you want checked.

Fred