I do NOT have config.active_record.whitelist_attributes = true
in application config. And I have attr_protected()
in the model class. However, I notice that the id
and type
attributes are automatically inserted into ActiveModel::MassAssignmentSecurity::BlackList
. This makes sense for id
attribute since we do not want to set id
in a mass assignment, but why this is also true for the type
attribute?
The attribute type
is used by active record when you are using single table inheritance between active record models, that's why it's in the black list. It holds the name of the class that was saved so Rails knows what kind of object was saved.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With