<commit_before>h1. sudo_attributes

Adds 'sudo' methods to active record classes, allowing you to easily override protected attributes.

h2. The Problem

ActiveRecord (ActiveModel in Rails 3) provides a convenient way to make your application more secure by using "protected" attributes. Protected attributes are assigned using either @attr_protected@ or @attr_accessible@. This adds security by preventing mass assignment of attributes when doing things like @user.update_attributes(params[:user])@. The issue is that it can be tedious to always manually assign protected attributes in an administrative area of your application. You may find yourself doing things like:

<pre>
user = User.find(params[:id])
user.update_attributes(params[:user])
user.admin = true
user.something_else = true
user.save
</pre>

h2. The Solution

SudoAttributes adds a few 'sudo' methods to your models, allowing you to override the protected attributes when you know the input can be trusted.

h2. Class Methods

The following class methods will be available to your models which can be used in place of @attr_protected@ and @attr_accessible@ respectively. You may still use the methods provided by rails, but you must still use one of these methods (without any arguments) in order to gain access to the other @Model.sudo_*@ methods:

* @sudo_attr_protected :field1, :field2@ - Creates protected attributes and adds instance methods to your model (see below)
* @sudo_attr_accessible :field1, :field2@ - Creates accessible attributes and adds instance methods to your model (see below)

You may also create new instances that override protected attributes using the following methods:

* @Model.sudo_create@ - Uses same syntax as @Model.create@ to instantiate and save an object with protected attributes
* @Model.sudo_new@ - Uses same syntax as @Model.new@ to instantiate, but not save an object with protected attributes

h2. Instance Methods

The following instance method is available to any ActiveRecord model and does not require the use of protected Class methods described above.

* @sudo_update_attributes@ - Uses identical syntax to @update_attributes@, but overrides protected attributes.

h2. Examples

**Protect an admin boolean attribute**

<pre>
class User < ActiveRecord::Base
  sudo_attr_protected :admin
end
</pre>

In your admin controller...

<pre>
params[:user] = {:name => "Pete", :admin => true} (Typically set from a form)

@user = User.sudo_create(params[:user])

Somewhere else in your admin controller...

params[:user] = {:admin => false, :name => "Pete"}

@user.sudo_update_attributes(params[:user)
</pre>
<commit_msg>Updated README with latest changes<commit_after>h1. sudo_attributes

Adds 'sudo' methods to active record classes, allowing you to easily override protected attributes.

h2. The Problem

ActiveRecord (ActiveModel in Rails 3) provides a convenient way to make your application more secure by using "protected" attributes. Protected attributes are assigned using either @attr_protected@ or @attr_accessible@. This adds security by preventing mass assignment of attributes when doing things like @user.update_attributes(params[:user])@. The issue is that it can be tedious to always manually assign protected attributes in an administrative area of your application. You may find yourself doing things like:

<pre>
user = User.find(params[:id])
user.update_attributes(params[:user])
user.admin = true
user.something_else = true
user.save
</pre>

h2. The Solution

SudoAttributes adds a few 'sudo' methods to your models, allowing you to override the protected attributes **when you know the input can be trusted**.

It's as easy as adding one method call to your models like so:

<pre>
class User < ActiveRecord::Base
  enable_sudo_attributes :admin
end
</pre>

h2. Class Methods

The class method *enable_sudo_attributes* will be available to all rails models. It accepts  and can be used in place of @attr_protected@ or @attr_accessible@. You may still use the default methods provided by rails, but you must still call @enable_sudo_attributes@ in order to gain access to the sudo methods:

* @enable_sudo_attributes :protected => :attribute1@ - Defines a single protected attribute and adds additional sudo methods to your model (see below)
* @enable_sudo_attributes :accessible => [:attribute1, :attribute2]@ - Defines two accessible attributes and adds additional sudo methods to your model
* @enable_sudo_attributes@ - With no arguments, it will rely on calls to @attr_protected@ or @attr_accessible@, but still adds sudo methods

Any model that calls @enable_sudo_attributes@ will also be able to create new instances that override protected attributes using the following methods:

* @Model.sudo_create@ - Uses same syntax as @Model.create@ to instantiate and save an object with protected attributes
* @Model.sudo_new@ - Uses same syntax as @Model.new@ to instantiate, but not save an object with protected attributes

h2. Instance Methods

The following instance method is available to any ActiveRecord model and does not require the use of protected Class methods described above.

* @sudo_update_attributes@ - Uses identical syntax to @update_attributes@, but overrides protected attributes.

h2. Examples

**Protect an admin boolean attribute**

<pre>
class User < ActiveRecord::Base
  enable_sudo_attributes :admin
end
</pre>

In your admin controller...

<pre>
params[:user] = {:name => "Pete", :admin => true} (Typically set from a form)

@user = User.sudo_create(params[:user])

Somewhere else in your admin controller...

params[:user] = {:admin => false, :name => "Pete"}

@user.sudo_update_attributes(params[:user)
</pre>

{'fraction_non_alphanumeric': 0.07198306280875089, 'fraction_numerical': 0.003705010585744531, 'mean_word_length': 5.222832052689353, 'pattern_counts': {'":': 0, '<': 20, '<?xml version=': 0, '>': 27, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1722064', 'n_tokens_mistral': 1499, 'n_tokens_neox': 1437, 'n_words': 722}