Last Updated: February 25, 2016
·
1.031K
· gacha

POST only permited parameters to Rails from railsResource in angularJS

This will help to POST only permitted attributes to your Rails app when executing 'update' on railsResource object.

Define transformer:

@app.factory('railsStrongParameters', ->
  (data, resource) ->
    if resource.permit
      for key of data
        unless angular.isFunction(data[key])
          unless key in resource.permit
            delete data[key]
    data
)

Then add it to your model transformers list:

@app.factory('Article', ['railsResourceFactory', (railsResourceFactory) ->
  Article = railsResourceFactory
    url: '/articles'
    name: 'article'
    requestTransformers: [
      'railsFieldRenamingTransformer',
      'railsStrongParameters',
      'railsRootWrappingTransformer'
    ]
  Article.permit = ['title', 'body']
  Article
])

Now you can just copy permitted attributes straight from Rails.

Have a fresh tip? Share with Coderwall community!

Post
Post a tip
Did you know?

AngularJS pages are long-lived browser apps with the same script risk as a newer single-page app. Third-party code in the template can read forms and values rendered on the page.

Security insights from Cside