set activerecord whitelist_attributes to true

1 files changed, 6 insertions, 0 deletions

diff --git a/config/application.rb b/config/application.rb
index ad41f19657f..27de3fa2436 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -39,6 +39,12 @@ module Gitlab
     # Configure sensitive parameters which will be filtered from the log file.
     config.filter_parameters += [:password]
 
+    # Enforce whitelist mode for mass assignment.
+    # This will create an empty whitelist of attributes available for mass-assignment for all models
+    # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
+    # parameters by using an attr_accessible or attr_protected declaration.
+    config.active_record.whitelist_attributes = true
+
     # Enable the asset pipeline
     config.assets.enabled = true