strong_parameters

>>Remember, if every student is failing your class, the student probably isn't the one to blame. Except not every student is failing the class. Only those not following best practices are. For example, if you're using params.permit!, you're simply being lazy. This is clearly documented[1]: "Extreme care should be taken when using permit! as it will allow all current and future model attributes to be mass-assigned." [1]https://github.com/rails/strong_parameters#permitted-scalar-...

This is an awesome achievement. There are so many improvements to this version that are not immediately visible, but which are maturing Rails in tremendous ways. I think it compares with the release of Mac OS X Snow Leopard (10.6). Especially in the perception on different types of users (experts to consumers). On a different note, moving from 3.2 can best be done one gem at the time. For instance, implement strong parameters and you're one step closer to Rails 4. https://github.com/rails/strong_parameters

This seems like a great idea! I have a few thoughts that comes to mind, perhaps others can chip in: - How can this be used in tandem with strong_parameters; should ensuring the structure of params be a responsibility of the controller or the mutation (I'm leaning towards the former)? [1] - How can validation duplication between models and mutations be avoided? In the example 'string :email, matches: EMAIL_REGEX' was used, but presumably one will still validate the email in the model. I'm guessing there are solutions to this, perhaps the existing model validation can somehow be used? [1]: https://github.com/rails/strong_parameters

This sounds a lot like strong_parameters, which (I believe) will be the default in Rails 4, and is only a gem install away from Rails 3.2 apps. https://github.com/rails/strong_parameters

This has been solved already and will be part of Rails 4. Use strong parameters: https://github.com/rails/strong_parameters