ruby-on-rails - 无法批量分配 protected 属性

Question

我的 features 文件是这样看的:

Given there are the following users:
    | email              | password | admin |
    | admin@ticketee.com | password | true  |

而且我的 user 模型没有将 admin 属性声明为 attr_accessible 以防止批量分配。因此，我对 user_steps.rb 文件进行了更改以解决此问题。

Given /^there are the following users:$/ do |table|
  table.hashes.each do |attributes|
   unconfirmed = attributes.delete("unconfirmed") == "true"
   @user = User.create!(attributes)
   @user.update_attribute("admin", attributes["admin"] == "true")
   @user.confirm! unless unconfirmed
 end
end

现在这应该根据书 - Rails3 in action 工作。我也检查了他们 online repo 上的代码。
用 cucumber 运行它会出现以下错误:

Can't mass-assign protected attributes: admin (ActiveModel::MassAssignmentSecurity::Error)
  ./features/step_definitions/user_steps.rb:4:in `block (2 levels) in <top (required)>'
  ./features/step_definitions/user_steps.rb:2:in `each'
  ./features/step_definitions/user_steps.rb:2:in `/^there are the following users:$/'
  features/creating_projects.feature:7:in `Given there are the following users:'

任何帮助将不胜感激。我真的无法弄清楚这里出了什么问题。

非常感谢!

Answer 1

在用户模型中添加:

attr_accessible :admin

更新:
admin 属性可以批量分配，任何黑客都可以通过发送参数轻松设置它。