Merge pull request #7847 from bloudermilk/recursive_permit

ActionController::Parameters#permit! is recursive

3 files changed, 15 insertions, 0 deletions

diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index f07c6fe828..83ce094b50 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,5 +1,8 @@
 ## Rails 4.0.0 (unreleased) ##
 
+*   `ActionController::Parameters#permit!` is now recursive. *Brendan
+    Loudermilk*
+
 *   `ActionController::Base.page_cache_extension` option is deprecated
     in favour of `ActionController::Base.default_static_extension`.
 
diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb
index c9a81e4866..36fce81d1c 100644
--- a/actionpack/lib/action_controller/metal/strong_parameters.rb
+++ b/actionpack/lib/action_controller/metal/strong_parameters.rb
@@ -112,6 +112,11 @@ module ActionController
     #   params.permitted?  # => true
     #   Person.new(params) # => #<Person id: nil, name: "Francesco">
     def permit!
+      each_pair do |key, value|
+        convert_hashes_to_parameters(key, value)
+        self[key].permit! if self[key].respond_to? :permit!
+      end
+
       @permitted = true
       self
     end
diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index 7fe8e6051b..18bb51c5a3 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -57,6 +57,13 @@ class ParametersPermitTest < ActiveSupport::TestCase
     assert_equal @params.permitted?, @params.dup.permitted?
   end
 
+  test "permit is recursive" do
+    @params.permit!
+    assert @params.permitted?
+    assert @params[:person].permitted?
+    assert @params[:person][:name].permitted?
+  end
+
   test "permitted takes a default value when Parameters.permit_all_parameters is set" do
     begin
       ActionController::Parameters.permit_all_parameters = true