Details
-
Type:
Improvement
-
Status:
Closed
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 1.0.4
-
Fix Version/s: 1.2 final
-
Component/s: Documentation
-
Labels:None
Description
The current documentation only state how to exclude fields.
E.g.
bindData(sc, params, ['myReadOnlyProp'])
But the other way around - defining which fields to include - is also possible but not documented. From a security point of view this is a much better approach.
This can be done by:
bindData(sc, params, [include: ['property1', 'property2']]) // will only bind prop1 and 2 but not other properties on the request
bindData(sc, params, [exclude: ['property3', 'property4']]) // will not bind prop3 and 4 but other properties on the request will be binded
Sections to update in the documentation:
http://grails.org/doc/1.0.x/ref/Controllers/bindData.html
http://grails.org/doc/1.0.x/guide/6.%20The%20Web%20Layer.html#6.1.6%20Data%20Binding --> paragraph Data Binding and Security concerns
Issue Links
| This issue relates to: | ||||
| GRAILS-998 | Refactor bindData to remove 3 param form with "excludes" list and replace with 3 param form that takes Map as 3rd param with "includes" and "excludes" support |
|
|
|
Additionally, and I'm not sure if this is a bug or intended behavior, it's NOT possible to include or exclude associations using the include: or exclude: map keys.
e.g. You want to disallow modification of the address assigned to the person:
class Person {
Address address
String name
Date createdAt
}
class Address {
String Line1
String Line2
}
...
If you update the scaffolded code in the PersonController's update action closure from:
personInstance.properties = params
to:
bindData(personInstance, params, [include: ['name']])
or:
bindData(personInstance, params, [exclude: ['address.id']])
the person.address property's id field is updated if changed using the drop-down form control.
I would also like to be able to do this:
bindData(personInstance, params, [exclude: ['createdAt', 'address.id']])
that is: disallow changes to the person instance's createdAt timestamp and the address associated with it.
If it's possible, it should be documented, if it's not it should be implemented or if there's another preferred way please tell us.