search

stffn / declarative_authorization

An unmaintained authorization plugin for Rails. Please fork to support current versions of Rails
MIT License
1.24k stars 233 forks source link

Serialize value bypass authorization #132

Closed jeromelefeuvre closed 12 years ago

jeromelefeuvre commented 12 years ago

Hi,

I hope it's me but I have serialize field (serialize :point_of_sale_ids, Array).

When I add an authorization on this field and test it. Authorization is bypassed and I can updated this field.

Thanks for the feedback

Jerome

stffn commented 12 years ago

Please expand a bit. Can you provide the rules you are using? Serialized values will certainly not work for query rewriting (with_permissions_to), but should work in filter rules for the controller and for permitted_to? etc.