我可以在Ruby on Rails中将attr_accessible用于PayPal IPN吗？

Question

I used this RailsCast to create part of a shopping cart system, http://railscasts.com/episodes/142-paypal-notifications

There is a piece of code there that is called by PayPal for notification.

def create
  PaymentNotification.create!(:params => params, :cart_id => params[:invoice], :status => params[:payment_status], :transaction_id => params[:txn_id])
  render :nothing => true
end

I tried it on Heroku, and there were no warnings and no errors. The PaymentNotification object was created successfully in the database - but everything was nil except for the id! I opened the heroku console and tried:

irb(main):002:0> PaymentNotification.create!(:cart_id => "2", :status => "Complete", :transaction_id => "XYZXYZXYZXYZXYZ")
< => "2", :status => "Complete", :transaction_id => "XYZXYZXYZXYZXYZ")

Which gave me this,

WARNING: Can't mass-assign protected attributes: cart_id, status, transaction_id

Why didn't this warning come up in the Heroku logs? Why was it created successfully anyway (is it because it's just a warning, and not an error?)

Can I just use attr_accessible for these things? The notification has to be validated anyway ( https://www.paypal.com/cgi-bin/webscr?cmd=p/acc/ipn-info-outside )

Answer 1

For app security, you must add attr_accessible to your attributes.

On rails 4 is added this gem https://github.com/rails/strong_parameters . Also

I recomend to you use adaptive payments. You can take a look to this post:

Paypal Adaptive Payment for Ruby