Here you should use attr_protectedinstead attr_readonly. Then you will be protected from mass assignment of forms.
attr_protected :my_field
obj = MyModel.new({:my_field => "dsadsad"})
obj.my_field
obj.my_field = "ololo"
obj.my_field
EDIT
Situation: you need to install emailonly once: when creating the user. Then you want to edit the email only if you are an administrator.
attr_protected :email
def create
@user = User.new params[:user]
@user.email = params[:user][:email]
@user.save
respond_with @user
end
def update
@user = User.find params[:id]
@user.email = params[:user][:email] if curent_user.admin?
@user.update_attributes params[:user]
respond_with @user
end
Also check out: http://railscasts.com/episodes/237-dynamic-attr-accessible
fl00r source
share