4

I do NOT have config.active_record.whitelist_attributes = true in application config. And I have attr_protected() in the model class. However, I notice that the id and type attributes are automatically inserted into ActiveModel::MassAssignmentSecurity::BlackList. This makes sense for id attribute since we do not want to set id in a mass assignment, but why this is also true for the type attribute?

Mori
  • 27,279
  • 10
  • 68
  • 73
powerboy
  • 10,523
  • 20
  • 63
  • 93

1 Answers1

9

The attribute type is used by active record when you are using single table inheritance between active record models, that's why it's in the black list. It holds the name of the class that was saved so Rails knows what kind of object was saved.

mu is too short
  • 426,620
  • 70
  • 833
  • 800
Maurício Linhares
  • 39,901
  • 14
  • 121
  • 158
  • Does this mean I should not use a column named "type" in the database? – powerboy Jun 18 '12 at 03:06
  • 3
    Yup, you shouldn't. Also, `type` is used to return the `Class` instance of your object, so not even Rails should be using it ;) – Maurício Linhares Jun 18 '12 at 03:07
  • [This question](http://stackoverflow.com/questions/7134559/rails-use-type-column-without-sti) suggests to use `set_inheritance_column` to give this magic column a different name. Is it safe to do so? – powerboy Jun 18 '12 at 03:16
  • 1
    IMO, this is a really bad idea to pick such a popular name as the name of a magic column. – powerboy Jun 18 '12 at 03:23
  • 1
    Yeah, bad idea, just name it something else, you might use a gem/plugin/whatever that doesn't respect that config and it could trip you up. – Maurício Linhares Jun 18 '12 at 03:30