Module | Merb::ParamsFilter::ControllerMixin::ClassMethods |
In: |
lib/merb-param-protection.rb
|
Filters parameters out from the default log string
Params will still be passed to the controller properly, they will show up as [FILTERED] in the merb logs.
args: | Params that will be filtered |
log_params_filtered :password, 'token'
:api: public
Ensures these parameters are sent for the object
args: | Params that will be filtered |
# The request sets: params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } } MyController < Application params_accessible :post => [:title, :body] end params.inspect # => { :post => { :title => "ello", :body => "Want it" } }
So we see that params_accessible removes everything except what is explictly specified.
:api: public
Protects parameters of an object
args: | Params that will be filtered |
# The request sets: params => { :post => { :title => "ello", :body => "Want it", :status => "green", :author_id => 3, :rank => 4 } } MyController < Application params_protected :post => [:status, :author_id] end params.inspect # => { :post => { :title => "ello", :body => "Want it", :rank => 4 } }
So we see that params_protected removes ONLY those parameters explicitly specified.
:api: public