{"issue":{"state":"open","pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"user":{"avatar_url":"https://secure.gravatar.com/avatar/6180d7335815945eda8651e080be4b98?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"6180d7335815945eda8651e080be4b98","url":"https://api.github.com/users/balexand","login":"balexand","id":181187},"milestone":null,"updated_at":"2011-11-06T19:28:43Z","labels":[],"assignee":null,"comments":1,"closed_at":null,"url":"https://api.github.com/repos/jnunemaker/mongomapper/issues/343","body":"In ActiveRecord, when `attr_accessible` is called with no args then attributes are filtered using an empty whitelist. MongoMapper is not consistent with this behavior:\r\n\r\n    class Foo\r\n      include MongoMapper::Document\r\n      attr_accessible\r\n\r\n      key :name, String\r\n    end\r\n\r\n    describe Foo do\r\n      # FAIL!\r\n      it \"should not mass assign name in constructor\" do\r\n        Foo.new(:name => \"value\").name.should_not == \"value\"\r\n      end\r\n    end\r\n\r\nA workaround is to pass an attribute name that doesn't exist:\r\n\r\n    attr_accessible :no_attributes_accessible","html_url":"https://github.com/jnunemaker/mongomapper/issues/343","title":"attr_accessible with no args not effective","number":343,"id":2157505,"created_at":"2011-11-06T19:25:48Z"},"action":"created","comment":{"user":{"avatar_url":"https://secure.gravatar.com/avatar/6180d7335815945eda8651e080be4b98?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"6180d7335815945eda8651e080be4b98","url":"https://api.github.com/users/balexand","login":"balexand","id":181187},"updated_at":"2011-11-06T19:28:43Z","url":"https://api.github.com/repos/jnunemaker/mongomapper/issues/comments/2647091","body":"For the security of those of us who are developing with MongoMapper but are familiar with ActiveRecord, I think this issue either needs to be fixed (preferible) or a warning should be posted in the [docs for attr_accessible](http://mongomapper.com/documentation/plugins/accessible.html). Thanks.","id":2647091,"created_at":"2011-11-06T19:28:43Z"}}