Merge pull request #12977 from strzalek/action-pack-variants

Action Pack Variants

1 files changed, 14 insertions, 0 deletions

diff --git a/actionpack/lib/action_dispatch/http/mime_negotiation.rb b/actionpack/lib/action_dispatch/http/mime_negotiation.rb
index 40bb060d52..41e6727315 100644
--- a/actionpack/lib/action_dispatch/http/mime_negotiation.rb
+++ b/actionpack/lib/action_dispatch/http/mime_negotiation.rb
@@ -10,6 +10,8 @@ module ActionDispatch
         self.ignore_accept_header = false
       end
 
+      attr_reader :variant
+
       # The MIME type of the HTTP request, such as Mime::XML.
       #
       # For backward compatibility, the post \format is extracted from the
@@ -64,6 +66,18 @@ module ActionDispatch
           end
       end
 
+      # Sets the \variant for template
+      def variant=(variant)
+        if variant.is_a? Symbol
+          @variant = variant
+        else
+          raise ArgumentError, "request.variant must be set to a Symbol, not a #{variant.class}. For security reasons," +
+                               "never directly set the variant to a user-provided value, like params[:variant].to_sym." +
+                               "Check user-provided value against a whitelist first, then set the variant:"+
+                               "request.variant = :tablet if params[:some_param] == 'tablet'"
+        end
+      end
+
       # Sets the \format by string extension, which can be used to force custom formats
       # that are not controlled by the extension.
       #