class_attribute is not a direct replacement of class_inheritable_*.

If you are setting a hash or an array in class_attribute or you need
to freeze it, to ensure people won't modify it in place or you need
to dup it on inheritance.

1 files changed, 2 insertions, 1 deletions

diff --git a/actionpack/lib/abstract_controller/view_paths.rb b/actionpack/lib/abstract_controller/view_paths.rb
index b331eb51b6..b552a649d1 100644
--- a/actionpack/lib/abstract_controller/view_paths.rb
+++ b/actionpack/lib/abstract_controller/view_paths.rb
@@ -5,6 +5,7 @@ module AbstractController
     included do
       class_attribute :_view_paths
       self._view_paths = ActionView::PathSet.new
+      self._view_paths.freeze
     end
 
     delegate :find_template, :template_exists?, :view_paths, :formats, :formats=,
@@ -61,7 +62,7 @@ module AbstractController
       # paths<ViewPathSet, Object>:: If a ViewPathSet is provided, use that;
       #   otherwise, process the parameter into a ViewPathSet.
       def view_paths=(paths)
-        self._view_paths = paths.is_a?(ActionView::PathSet) ? paths : ActionView::Base.process_view_paths(paths)
+        self._view_paths = ActionView::Base.process_view_paths(paths)
         self._view_paths.freeze
       end
     end