diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-25 11:25:11 -0800 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-25 11:25:11 -0800 |
| commit | 6dfab475ca230dfcad7a603483431c8e7a8f908e (patch) | |
| tree | 69ca8ade43b0e39e1d8cffa68390e9052e589acf /actionpack/lib/abstract_controller/rendering.rb | |
| parent | 14e92bac1a4c199e5e8936c6bdc64420293ea6d1 (diff) | |
| parent | 908c011395cc9e3ea1bb195f9d1bd30a9d9df98f (diff) | |
| download | rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.tar.gz rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.tar.bz2 rails-6dfab475ca230dfcad7a603483431c8e7a8f908e.zip | |
Merge branch '5-0-beta-sec'
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
Diffstat (limited to 'actionpack/lib/abstract_controller/rendering.rb')
| -rw-r--r-- | actionpack/lib/abstract_controller/rendering.rb | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/actionpack/lib/abstract_controller/rendering.rb b/actionpack/lib/abstract_controller/rendering.rb index a73f188623..63fd76d9b7 100644 --- a/actionpack/lib/abstract_controller/rendering.rb +++ b/actionpack/lib/abstract_controller/rendering.rb @@ -82,7 +82,13 @@ module AbstractController # <tt>render :file => "foo/bar"</tt>. # :api: plugin def _normalize_args(action=nil, options={}) - if action.is_a? Hash + case action + when ActionController::Parameters + unless action.permitted? + raise ArgumentError, "render parameters are not permitted" + end + action + when Hash action else options |