Is there a better way to update fields in an web app?

Question

This is the stripped down version of my update action for a Posts (blog post) controller:

Posts.update = function(req, res){
    _.extend(req.post, {
        title: req.body.title
    ,   author: req.body.author
    ,   body: req.body.body
    });
    post.save();
};

This way feels a bit clumsy and repetitive, because I have similar code in another method, but I don't want to just straight up _.extend(req.post, req.body) because it may allow someone to change fields that shouldn't be changed in my models.

Is there a better middle ground?

Answer 1

How about _.pick()?

Posts.update = function(req, res){
    _.extend(req.post, _.pick(req.body, 'title', 'author', 'body'));
    post.save();
};