attr-accessible can be damaging, is not always necessary.

[graemeworthy]

Problem:

changes in the attr accessable patch from fabn/attr-accessible-patch
cause a problem on any model which does not already have attr_accessible set
and as a result triggers the "Can't mass-assign protected attributes"

commit where problem was introduced:

md5: d8c24c0

Test for problem:

The example included here in a test shows that adding attr_accessible to a model that
does not currently have mass assignment protection enabled, triggers mass_assignment
protection.

Solution:

I understand that this patch was inteded as a workaround, so as to add 'position'
to the list of available mass assignable attributes of the model,

The problem that required the offending patch is addressable in another manner:
it is not necessary to use 'update_attributes!' to set one known attribute.
instead, i have altered this to use update_attribute, as it doesn't trigger mass_assignment protection.
update_attribute only updates one attribute at a time, therefore avoiding 'mass' assignment.

that being said, it may still be desirable to add 'position' (or it's configured alternate)
to the list of mass_assignable attributes, but only if there is already such a list,

this patch performs a check to see if here is already a whitelist, and if so, adds itself to it.

[swanandp]

There was a recent pull request, which addressed the same issue. It wrapped the column update in a separate method, which will then use the []= method. Can you check if it works for you?

[graemeworthy]

I have incorporated the changes made by vesan in the recent pull request #56.
Using direct assignment does indeed avoid triggering mass assignment.

in issue #50 people were complaining that :position was not set accessible

I don't want to make it accessible and I didn't have to in the past. Could you add support for non accessible position > like there use to be?

My changeset here also includes a test to ensure that attr_accessible is not arbitrarily set.
And provides a mechanism for adding position_column to the attr_accessible list were there to be one.

[swanandp]

Looks good, thanks!