<commit_before># ParamAccessible

[![Build Status](https://secure.travis-ci.org/topdan/param_accessible.png)](https://secure.travis-ci.org/topdan/param_accessible.png)

Provides a method to help protect your Ruby on Rails controllers from malicious or accidentally destructive user parameters. It is independent, but heavily influenced by param_protected.

Make all your controllers secure by default as well as provide readable messages to users when a security breach was prevented.

For more information on the design considerations please visit: https://www.topdan.com/ruby-on-rails/params-accessible.html

## Installation

Add this line to your application's Gemfile:

    gem 'param_accessible'

And then execute:

    $ bundle

Or install it yourself as:

    $ gem install param_accessible

## Usage

1. This gem does not add any functionality by default. To activate it create a before_filter in any ActionController::Base subclass. We only use the filter for create and update actions because those are the normally only the only harmful ones:

    before_filter :ensure_params_are_accessible, :only => [:create, :update]

2. Now let's expose the most common rails parameters: controller, action, format, and id

    param_accessible :controller, :action, :format, :id

3. We also want to make sure only admins can change a user's "is_admin" and "is_active" attributes:

    param_accessible :user => [:is_admin, :is_active], :if => :is_admin?

4. Rinse and repeat for all your controllers and you're Rails Application will be much safer.

## Example

Making create and update actions secure by default for all your application's controllers, exposing common parameters, and providing a readable error message to the user when there is a problem.

    class ApplicationController < ActionController::Base
      
      # make all your controllers secure by default
      before_filter :ensure_params_are_accessible, :only => [:create, :update]
      
      # expose the common rails parameters
      param_accessible :controller, :action, :format, :id
      
      # this error is thrown when the user tries to access an inaccessible param
      rescue_from ParamAccessible::Error, :with => :handle_param_not_accessible
      
      protected
      
      def handle_param_not_accessible e
        flash[:error] = "You gave me some invalid parameters: #{e.inaccessible_params.join(', )}"
        redirect_to :back
      end
      <commit_msg>numbers are blocking the code tags<commit_after># ParamAccessible

[![Build Status](https://secure.travis-ci.org/topdan/param_accessible.png)](https://secure.travis-ci.org/topdan/param_accessible.png)

Provides a method to help protect your Ruby on Rails controllers from malicious or accidentally destructive user parameters. It is independent, but heavily influenced by param_protected.

Make all your controllers secure by default as well as provide readable messages to users when a security breach was prevented.

For more information on the design considerations please visit: https://www.topdan.com/ruby-on-rails/params-accessible.html

## Installation

Add this line to your application's Gemfile:

    gem 'param_accessible'

And then execute:

    $ bundle

Or install it yourself as:

    $ gem install param_accessible

## Usage

This gem does not add any functionality by default. To activate it create a before_filter in any ActionController::Base subclass. We only use the filter for create and update actions because those are the normally only the only harmful ones:

    before_filter :ensure_params_are_accessible, :only => [:create, :update]

Now let's expose the most common rails parameters: controller, action, format, and id

    param_accessible :controller, :action, :format, :id

We also want to make sure only admins can change a user's "is_admin" and "is_active" attributes:

    param_accessible :user => [:is_admin, :is_active], :if => :is_admin?

Rinse and repeat for all your controllers and you're Rails Application will be much safer.

## Example

Making create and update actions secure by default for all your application's controllers, exposing common parameters, and providing a readable error message to the user when there is a problem.

    class ApplicationController < ActionController::Base
      
      # make all your controllers secure by default
      before_filter :ensure_params_are_accessible, :only => [:create, :update]
      
      # expose the common rails parameters
      param_accessible :controller, :action, :format, :id
      
      # this error is thrown when the user tries to access an inaccessible param
      rescue_from ParamAccessible::Error, :with => :handle_param_not_accessible
      
      protected
      
      def handle_param_not_accessible e
        flash[:error] = "You gave me some invalid parameters: #{e.inaccessible_params.join(', )}"
        redirect_to :back
      end
      
{'fraction_non_alphanumeric': 0.06638159234371818, 'fraction_numerical': 0.0008144980655670943, 'mean_word_length': 4.012244897959183, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 13, 'https://': 6, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6551725', 'n_tokens_mistral': 1313, 'n_tokens_neox': 1221, 'n_words': 551}