added attr_protected calls to protect mass assignment of :project_id through a view

13 years ago · fae3145eb2
parent b23680f0fe
commit fae3145eb2
1 changed files with 2 additions and 0 deletions
--- a/lib/report.rb
+++ b/lib/report.rb
@ -14,6 +14,8 @@ class Report < ActiveRecord::Base
  before_save :serialize
  serialize :serialized, Hash
  
+  attr_protected :project_id #, :user_id
+
  self.abstract_class = true # lets have subclasses have their own SQL tables

  def self.accepted_properties