spikex / strongbox

Secures ActiveRecord attributes with public key encryption
http://stuff-things.net/2009/04/17/introducing-strongbox/
MIT License
397 stars 43 forks source link

Impossible to reset protected field to nil #7

Closed haarts closed 13 years ago

haarts commented 13 years ago

When trying to set the field to nil, nil gets encrypted. u = User.first u.secret = nil u.save u = User.first u.secret.nil? => false

spikex commented 13 years ago

All data is encrypted, nil, blank, or otherwise, to avoid revealing anything about the data. If you which to store an unencrypted nil (or anything else for that matter) you can explicitly set the attribute:

u[:secret] = nil u.secret.nil? => true

This could be a lot more consistent and there should be a option to disable the behavior, I'll add it to my to-do.

haarts commented 13 years ago

That makes sense! Thanks for the reply and the workaround/solution.

mihaj commented 13 years ago

When I try to set encrypted field to blank (remove text of field from view), the data is retained and its not updated with blank. The form is not showing any errors.

haarts commented 13 years ago

That is because the resulting empty string is encrypted. Check in the controller is the string is empty and set the field to nil

mihaj commented 13 years ago

Like that?

if (params[:contact][:mobile].empty?)
  params[:contact][:mobile] = nil
end
haarts commented 13 years ago

Yep

mihaj commented 13 years ago

hum, it does not work for me. The value is retained and not set to nil. any clues?

spikex commented 13 years ago

hum, it does not work for me. The value is retained and not set to nil. any clues?

If you want to clear it you'll probably need to do something like:

@model[:attribute] = nil

and then save it.

mihaj commented 13 years ago

works like a charm. Thanks!