Fixed that .with_scope imposed create parameters bypass attr_protected

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@3393 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

2 files changed, 5 insertions, 2 deletions

diff --git a/activerecord/CHANGELOG b/activerecord/CHANGELOG
index 8841ada2be..6828c8848d 100644
--- a/activerecord/CHANGELOG
+++ b/activerecord/CHANGELOG
@@ -1,5 +1,7 @@
 *SVN*
 
+* .with_scope imposed create parameters now bypass attr_protected [Tobias Luetke]
+
 * Don't raise an exception when there are more keys than there are named bind variables when sanitizing conditions. [Marcel Molina Jr.]
 
 * Multiple enhancements and adjustments to DB2 adaptor. #3377 [contact@maik-schmidt.de]
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb
index 7ba5beb12b..dc3dc2afa6 100755
--- a/activerecord/lib/active_record/base.rb
+++ b/activerecord/lib/active_record/base.rb
@@ -444,9 +444,10 @@ module ActiveRecord #:nodoc:
         if attributes.is_a?(Array)
           attributes.collect { |attr| create(attr) }
         else
-          attributes.reverse_merge!(scope(:create)) if scoped?(:create)
-
           object = new(attributes)
+          if scoped?(:create)
+            scope(:create).each { |att,value| object.send("#{att}=", value) }
+          end
           object.save
           object
         end