{"issue":{"pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"state":"closed","milestone":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/164578b8d21de6e92453bbbfa17260ba?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"164578b8d21de6e92453bbbfa17260ba","url":"https://api.github.com/users/jerefrer","login":"jerefrer","id":140954},"assignee":null,"updated_at":"2011-11-17T14:27:15Z","labels":[],"closed_at":"2011-11-17T14:27:15Z","comments":0,"url":"https://api.github.com/repos/sferik/rails_admin/issues/839","body":"I'm using CanCan here, but this would also be an issue for other authentication systems I guess.\r\n\r\nIn my app I'd like to allow admins to edit the roles of other users, so I allowed the guys with admin role to :\r\n\r\n````\r\ncan :manage, User\r\ncan :read, Role (apparently needed by RailsAdmin just to list the roles in the HABTM form and therefore allow edition)\r\n````\r\n\r\nbut that wasn't working, so I googled around and [found that I needed to add :role_ids to the attr_accessible fields in my User model](http://groups.google.com/group/rails_admin/browse_thread/thread/2bca934168a70e11/9b330aa1ef2f98ea?show_docid=9b330aa1ef2f98ea).\r\n\r\nAnd indeed it's now working.\r\n\r\nBut what I realized a bit later is that **it's a major security issue since anyone can just mass-assign it's roles !**\r\n\r\nI then googled a bit to see if there was some way to define a dynamic attr_accessible, and then found this [Railscasts](http://asciicasts.com/episodes/237-dynamic-attr-accessible) explaining the use of the mass_assignment_authorizer method, so I added this to my User model :\r\n\r\n````\r\nprivate\r\ndef mass_assignment_authorizer\r\n  super + [:role_ids]\r\nend\r\n````\r\n\r\nAnd since it's now preventing a user from mass-assigning his roles (unless he is admin), I lost the ability to edit them in the RailsAdmin window.\r\n\r\nAny idea how I could have both a secure app and an easy and RailsAdmin-ish way to change my users roles ?","html_url":"https://github.com/sferik/rails_admin/issues/839","title":"User's roles edition needs mass assignment which leeds to major security issue","number":839,"id":2269240,"created_at":"2011-11-17T14:26:22Z"},"action":"closed"}