Merge pull request #39 from mezis/fix-mass-assignment

Fix mass assignment isses

.gitignore

@@ -1,6 +1,5 @@
 *.gem
 *.rbc
-.bundle
 .config
 .yardoc
 InstalledFiles
@@ -21,3 +20,7 @@ tmp
 # Data
 *.gz
 *.bz2
+
+# Bundler
+.bundle
+vendor/bundle

lib/fuzzily/searchable.rb

@@ -17,7 +17,12 @@ def self.included(by)
     def _update_fuzzy!(_o)
       self.send(_o.trigram_association).delete_all
       String.new(self.send(_o.field)).scored_trigrams.each do |trigram, score|
-        self.send(_o.trigram_association).create!(:score => score, :trigram => trigram, :owner_type => self.class.name)
+        self.send(_o.trigram_association).build.tap do |record|
+          record.score       = score
+          record.trigram     = trigram
+          record.fuzzy_field = _o.field.to_s
+          record.save!
+        end
       end
     end
 

spec/fuzzily/searchable_spec.rb

@@ -2,8 +2,11 @@
 
 describe Fuzzily::Searchable do
   # Prepare ourselves a Trigram repository
-  class Trigram < ActiveRecord::Base
-    include Fuzzily::Model
+  before do
+    silence_warnings do
+      Trigram = Class.new(ActiveRecord::Base)
+    end
+    Trigram.class_eval { include Fuzzily::Model }
   end
 
   before(:each) { prepare_trigrams_table }
@@ -83,6 +86,16 @@ def Stuff.name ; 'Stuff' ; end
       subject.last.update_fuzzy_name!
       Trigram.all.should be_empty
     end
+
+    if ActiveRecord::VERSION::MAJOR <= 3
+      let(:fields) {[ :score, :fuzzy_field, :trigram ]}
+      before { Trigram.attr_protected  fields }
+
+      it 'tolerates mass assignment security' do
+        subject.create!(:name => 'Paris')
+        subject.last.update_fuzzy_name!
+      end
+    end
   end
 
   describe '.bulk_update_fuzzy_<field>' do