Mass Assignment Security Refactoring

Thanks for the feedback! I've added the example documentation and also updated the implementation so that it can be extended for context-sensitive sanitization, as shown in the example in mass_assignment_security.rb. I would like to find a cleaner solution for this, but I think this approach requires the fewest API changes.

Round 3. Hmmm, refactored the refactoring and expanded the documentation a bit. This simplifies the implementation significantly. Don't plan to make any other changes unless requested.

Also added mass_assignment_security/context.rb. I'd be happy to move it to a plugin, although I think it's pretty useful, and it's optional to include it.

Also rewrote multi-parameter assignment, the ticket is at #3317 Multi-parameter assignment refactoring

And the patch:

Any chance of this making it in the next release? Hoping to utilize this in the near future.

Thanks!
-Eric

New patch against master.

Oh, this patch also modifies the documentation. Removed advise about using Hash.slice, and replaced it with this:

# Note that using <tt>Hash#except</tt> or <tt>Hash#slice</tt> in place of +attr_accessible+ 
# to sanitize attributes won't provide sufficient protection.

Edited by Rohit Arondekar for formating.

Woops. Adding indentation for private/protected and no spaces between modules and classes.

Bleh, scratch that -- this patch has a bug in it -- but I expect the style is correct :)

FWIW, this patch is no longer applying cleanly to master:

$ git apply /tmp/mass_assign_clean.diff -v
(...)
Checking patch activerecord/lib/active_record/base.rb...
error: while searching for:
    extend ActiveModel::Naming
    extend QueryCache::ClassMethods
    extend ActiveSupport::Benchmarkable

    include Validations
    include Locking::Optimistic, Locking::Pessimistic

error: patch failed: activerecord/lib/active_record/base.rb:2378
error: activerecord/lib/active_record/base.rb: patch does not apply
(...)