Is there a better way to update fields in an web app?

Question

This is the stripped down version of my update action for a Posts (blog post) controller:

Posts.update = function(req, res){
 _.extend(req.post, {
 title: req.body.title
 , author: req.body.author
 , body: req.body.body
 });
 post.save();
};

This way feels a bit clumsy and repetitive, because I have similar code in another method, but I don't want to just straight up _.extend(req.post, req.body) because it may allow someone to change fields that shouldn't be changed in my models.

Is there a better middle ground?

Answer 1

How about _.pick()?

Posts.update = function(req, res){
 _.extend(req.post, _.pick(req.body, 'title', 'author', 'body'));
 post.save();
};