doc/mass_assignment.rdoc in sequel-5.71.0 vs doc/mass_assignment.rdoc in sequel-5.72.0
- old
+ new
@@ -46,10 +46,10 @@
post.strict_param_setting = false
Since mass assignment by default allows modification of all column values except for primary key columns, it can be a security risk in some cases.
If you are dealing with untrusted input, you are generally going to want to restrict what should be updated.
-Sequel has <tt>Model#set_fields</tt> and <tt>Model#update_fields</tt> methods, which are designed to be used with untrused input.
+Sequel has <tt>Model#set_fields</tt> and <tt>Model#update_fields</tt> methods, which are designed to be used with untrusted input.
These methods take two arguments, the untrusted hash as the first argument, and a trusted array of field names as the second argument:
post.set_fields({title: 'T', body: 'B'}, [:title, :body])
Instead of looking at every key in the untrusted hash, +set_fields+ will iterate over the trusted field names, looking each up in the hash, and