Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP

Loading…

Do not show all objects if collection is given nil #595

Closed
dnagir opened this Issue · 5 comments

4 participants

@dnagir

The problem

Let's asume the following piece of code:

= simple_form_for [@project, @story] do |f|
  = f.association :documents, :as => :check_boxes, collection: @documents

This will show the list of documents that come from the @documents variable.
BUT when the variable is not assigned (probably by mistake, not being speced) and thus is treated as nil, then all the documents are loaded.

This is a "security" flow because all users from all projects will see all documents on the system.

Proposed solution

If nil (or something non-eumerable I guess) is passed as collection option, then raise an exception warning about it.

For backwards compatibility it may be an configuration option that can enable this behaviour.

@nashby
Collaborator

:+1: for something like that.

@carlosantoniodasilva
Collaborator

Sounds ok to raise an exception when collection key is present but nil. I think there's no need for a config option though, if anyone is doing that by mistake we'll probably be nicer by telling them as you said :)

As a side note, we'd expect something like that to be caught by the developer before sending something to production, hopefully :D.

@nashby
Collaborator

What about just render a blank select without exception?

@rafaelfranca

@nashby for me sounds good.

@carlosantoniodasilva
Collaborator

Yeah, I think it's fine :metal:.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.