Controller classes allow you to change data in the database through fraudulent requests

How are we supposed to differentiate between a fraudulent request and one that intentionally supports adding a Product and editing the User at the same time?

Nothing is forcing you to use the generated controller code, e.g. "def instance = new Whatever(params)". You can extract data from the params object manually, or use the bindData method; see "Data Binding and Security concerns" in the docs: http://grails.org/doc/latest/guide/theWebLayer.html#dataBinding

Instead of assigning the request parameters as follows:

ProdutoInstance product = new Product (params)

i tried something like this:

ProdutoInstance product = new Product ()

productInstance.name = params.name
productInstance.description = params.description
productInstance.owner Product.get = (params ['owner.id'] as long)

But this did not prevent a request like the one below to change the name of the owner of a product.

http://localhost:8080/aplicationName/product/save?name=TV&description=Good&owner.id=1&owner.name=newName

Sorry, but i did not found a solution for this problem in the documentation.

Just correcting the previous post that has some mistakes.

Instead of assigning the request parameters as follows:

Product productInstance = new Product (params)

i tried something like this (extracting data from the params object manually):

Product productInstance = new Product ()

productInstance.name = params.name
productInstance.description = params.description
productInstance.owner = Product.get = (params ['owner.id'] as long)

But this did not prevent a request like the one below to change the name of the owner of a product.

http://localhost:8080/aplicationName/product/save?name=TV&description=Good&owner.id=1&owner.name=newName

Sorry, but i did not find a solution for this problem in the documentation.

Please create a small test app that demonstrates this. Run "grails bug-report" and attach the generated zip file here and I'll take a look.

How do i attach the zip file here?

I've reopened it so you can attach files.

To see what i mean as a problem, just execute the application and submit this URL:

http://localhost:8080/test/product/save?name=TV&description=good&user.id=2&user.name=newName

and you will see that the name of the user with id=2 was changed from Jorge to newName.

I think i understood what is going on. A persistent object is being retrieved from the database and assigned to the user field of ProductCommand. Then the ProductCommand object is being updated and that propagates the update to the database. That's it, right?

Sorry to bother you, in order to understand what is happening. I realised that the user field of the ProductCommand class should be transient or of type UserCommand. Sorry about that.

To solve the problem of possible fraudulent requests, i stopped using closures for command validation, i e, i replaced the following lines

{class ProductController
...
def save = {
ProductCommand pc ->

if (pc.hasErrors ())

else
{
...

by this lines of code:

{class ProductController
...
def save = {
ProductCommand pc = new ()
BindData (cp, params, [include: ['name', 'description', 'user']])
pc.validate ()
if (pc.hasErrors ())

else
{
ProductInstance product = new Product ()
BindData (productInstance, params, [include: ['name', 'description', 'user']])
if (productInstance.save (flush: true))
...

The problem is that now i am experiencing the following error when I run the validate() method on the ProductCommand object:

No signature of method: model.ProductCommand.validate () is Applicable for argument types: () values: []

But this error only happened when i removed from the ProductController the last closure that was validating de command object.

So if i add the action below (that uses a closure to validate a ProductComand object) to the ProductController, the error disappers:

def abc =

Should I create a new issue for this problem?

This doesn't look like a bug.

Not a Bug? It was fixed in Grails 2.

Who fixed it?

I don't think the behavior described in the description is a bug and I am not sure what might have been fixed about it. Anyone?

ok, perhaps not a bug, but a not desired characteristic. In Grails 2 this characteristic does not exist anymore.