Changeset 6051

Timestamp:

01/28/07 01:31:31 (2 years ago)

Author:

rick

Message:

Don't create instance writer methods for class attributes. Closes #7401 [Rick]

Files:

• trunk/activerecord/CHANGELOG (modified) (1 diff)
• trunk/activerecord/lib/active_record/base.rb (modified) (8 diffs)
• trunk/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb (modified) (1 diff)
• trunk/activerecord/lib/active_record/locking/optimistic.rb (modified) (1 diff)
• trunk/activerecord/lib/active_record/timestamp.rb (modified) (1 diff)
• trunk/activerecord/test/base_test.rb (modified) (1 diff)

trunk/activerecord/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Don't create instance writer methods for class attributes.  Closes #7401 [Rick]
-
-* Docs: validations examples.  #7343 [zackchandler]

trunk/activerecord/lib/active_record/base.rb

@@ -266 +266 @@
-    # Accepts a logger conforming to the interface of Log4r or the default Ruby 1.8+ Logger class, which is then passed
-    # on to any new database connections made and which can be retrieved on both a class and instance level by calling +logger+.
-
+, :instance_writer => false
-    
-    include Reloadable::Deprecated
@@ -292 +292 @@
-    @@subclasses = {}
-
-
+, :instance_writer => false
-    @@configurations = {}
-
@@ -299 +299 @@
-    # the primary column. If the latter is specified, the Product class will look for "product_id" instead of "id". Remember
-    # that this is a global setting for all Active Records.
-
+, :instance_writer => false
-    @@primary_key_prefix_type = nil
-
@@ -305 +305 @@
-    # table names will be named like "basecamp_projects", "basecamp_people", etc. This is a convenient way of creating a namespace
-    # for tables in a shared database. By default, the prefix is the empty string.
-
+, :instance_writer => false
-    @@table_name_prefix = ""
-
-    # Works like +table_name_prefix+, but appends instead of prepends (set to "_basecamp" gives "projects_basecamp",
-    # "people_basecamp"). By default, the suffix is the empty string.
-
+, :instance_writer => false
-    @@table_name_suffix = ""
-
@@ -316 +316 @@
-    # If true, the default table name for a +Product+ class will be +products+. If false, it would just be +product+.
-    # See table_name for the full rules on table/class naming. This is true, by default.
-
+, :instance_writer => false
-    @@pluralize_table_names = true
-
@@ -322 +322 @@
-    # make it much easier to overview things during debugging (when used through a reader like +tail+ and on a black background), but
-    # may complicate matters if you use software like syslog. This is true, by default.
-
+, :instance_writer => false
-    @@colorize_logging = true
-
-    # Determines whether to use Time.local (using :local) or Time.utc (using :utc) when pulling dates and times from the database.
-    # This is set to :local by default.
-
+, :instance_writer => false
-    @@default_timezone = :local
-
-    # Determines whether or not to use a connection for each thread, or a single shared connection for all threads.
-    # Defaults to false. Set to true if you're writing a threaded application.
-
+, :instance_writer => false
-    @@allow_concurrency = false
-
@@ -339 +339 @@
-    # attributes by name. You might want to set this to false in development
-    # mode, because the methods would be regenerated on each request.
-
+, :instance_writer => false
-    @@generate_read_methods = true
-    
@@ -348 +348 @@
-    # supports migrations.  Use :ruby if you want to have different database
-    # adapters for, e.g., your development and test environments.
-
+, :instance_writer => false
-    @@schema_format = :ruby
-

trunk/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb

@@ -12 +12 @@
-    # Check for activity after at least +verification_timeout+ seconds.
-    # Defaults to 0 (always check.)
-
+, :instance_writer => false
-    @@verification_timeout = 0
-

trunk/activerecord/lib/active_record/locking/optimistic.rb

@@ -27 +27 @@
-        base.extend ClassMethods
-
-
+, :instance_writer => false
-        base.lock_optimistically = true
-

trunk/activerecord/lib/active_record/timestamp.rb

@@ -24 +24 @@
-      base.alias_method_chain :update, :timestamps
-
-
+, :instance_writer => false
-      base.record_timestamps = true
-    end

trunk/activerecord/test/base_test.rb

@@ -749 +749 @@
-    assert_equal 1, firm.rating
-  end
+  
+  def test_mass_assignment_protection_against_class_attribute_writers
+    [:logger, :configurations, :primary_key_prefix_type, :table_name_prefix, :table_name_suffix, :pluralize_table_names, :colorize_logging,
+      :default_timezone, :allow_concurrency, :generate_read_methods, :schema_format, :verification_timeout, :lock_optimistically, :record_timestamps].each do |method|
+      assert  Task.respond_to?(method)
+      assert  Task.respond_to?("#{method}=")
+      assert  Task.new.respond_to?(method)
+      assert !Task.new.respond_to?("#{method}=")
+    end
+  end
-
-  def test_customized_primary_key_remains_protected