Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add documentation about wildcard includes #1201

Merged
merged 1 commit into from
Oct 2, 2015
Merged

Conversation

hut8
Copy link
Contributor

@hut8 hut8 commented Sep 25, 2015

Resolves #1200

render @posts, include: params[:include]
```

This raises some security concerns since the user could pass in `include=**`, so filter the values for `include` appropriately if you decide to support this JSON API feature.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 whitelist ftw

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice to mention this.

@beauby
Copy link
Contributor

beauby commented Sep 27, 2015

@hut8 Thanks for the PR, we really need this. Please see my comments.

@hut8
Copy link
Contributor Author

hut8 commented Oct 1, 2015

@beauby Better?

render @posts, include: '**' # or '*' for a single layer
```

The following would render posts and include every resource referenced by the posts' authors' comments (recursively). It could be combined, like above, with other paths in any combination desired.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about

include the author, the author's comments, and every resource referenced by the authors' comments (recursively)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM other than this. Sorry for being a bit a bit tedious on this PR but I can foresee many issues caused by people misunderstanding this functionality.

@hut8
Copy link
Contributor Author

hut8 commented Oct 1, 2015

@beauby Not tedious at all! It's important to make these things clear and this is a pretty awesome gem. I'm glad to be able to help.

render @posts, include: '**' # or '*' for a single layer
```

The following would render posts and include the author, the author's comments, and every resource by the author's comments (recursively). It could be combined, like above, with other paths in any combination desired.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seems to be a missing word here:

and every ??? resource by the author's comments (recursively)

@beauby
Copy link
Contributor

beauby commented Oct 1, 2015

See my last remark, then let's squash and merge!

@hut8
Copy link
Contributor Author

hut8 commented Oct 1, 2015

Seemas though I accidentally a word. Fixed. Squashed and pushed.

@bf4 bf4 added V: 0.10.x and removed V: 0.10.x labels Oct 2, 2015
@beauby
Copy link
Contributor

beauby commented Oct 2, 2015

LGTM, merging. Thanks a lot @hut8!

beauby added a commit that referenced this pull request Oct 2, 2015
Add documentation about wildcard includes
@beauby beauby merged commit 0669901 into rails-api:master Oct 2, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants