search

monterail / guidelines

[DEPRECATED] We are Ruby on Rails experts from Poland. Think hussars. Solid & winged. These are our guidelines.
71 stars 17 forks source link

Don't use the same model (table) for Admin and User #167

Closed sheerun closed 11 years ago

sheerun commented 11 years ago

For an attacker it's easier to change user.admin = true (for example when application doesn't use strong_parameters or whitelisted attributes), then add new Admin record.

Besides, when Admin and User are on the same table, STI is used, which sucks.

teamon commented 11 years ago

.. and this will give you false feeling of security ...

jandudulski commented 11 years ago

Agree with @teamon, using dumb tricks doesn't improve security.

sheerun commented 11 years ago

You missed part about STI. And this is not dumb trick, I gave you specific example.

teamon commented 11 years ago

If you have only admin? on User class there is not STI. Following this way of thinking we should put everything in separate tables, like account.owner_id = my_id and others. user.admin = true is not a special case here.