Many commentators (e.g. [ZDNet](http://www.zdnet.com/blog/security/how-github-handled-getting-hacked/10473)) have suggested that the weakness in GitHub's case was that the model [Homakov discovered was vulnerable](http://homakov.blogspot.co.uk/2012/03/how-to.html) had mass assignment enabled for its attributes.

However, I think the problem was not this, but was rather a failure to use a `before_filter` (or suchlike) in the controller to ensure that any given row in the table he updated could only be updated by an admin or by the user with the ID listed in that row. If such a filter had been in place in the controller, then the table would have been secured from attack ***even if the model's attributes were mass assignable***.

Am I correct?