diff options
| author | Steve Hull <sdhull@users.noreply.github.com> | 2018-04-16 12:50:18 -0700 |
|---|---|---|
| committer | Steve Hull <sdhull@users.noreply.github.com> | 2018-04-16 14:38:20 -0700 |
| commit | e539f2d5850c00ba40514af9b8f1961b0f208fe6 (patch) | |
| tree | 06cf768148d5020ac73a7dad5320f2b134bcf3dd /actionpack/test | |
| parent | 37b373a8d2a1cd132bbde51cd5a3abd4ecee433b (diff) | |
| download | rails-e539f2d5850c00ba40514af9b8f1961b0f208fe6.tar.gz rails-e539f2d5850c00ba40514af9b8f1961b0f208fe6.tar.bz2 rails-e539f2d5850c00ba40514af9b8f1961b0f208fe6.zip | |
Fixes StrongParameters permit! to work with nested arrays
`permit!` is intended to mark all instances of `ActionController::Parameters` as permitted, however nested arrays of params were not being marked permitted because the method did shallow iteration.
This fixes that by flattening the array before calling `permit!` on all each item.
Diffstat (limited to 'actionpack/test')
| -rw-r--r-- | actionpack/test/controller/parameters/parameters_permit_test.rb | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb index e60003dc64..2183a46da8 100644 --- a/actionpack/test/controller/parameters/parameters_permit_test.rb +++ b/actionpack/test/controller/parameters/parameters_permit_test.rb @@ -353,12 +353,15 @@ class ParametersPermitTest < ActiveSupport::TestCase assert_equal "Jonas", @params[:person][:family][:brother] end - test "permit is recursive" do + test "permit! is recursive" do + @params[:nested_array] = [[{ x: 2, y: 3 }, { x: 21, y: 42 }]] @params.permit! assert_predicate @params, :permitted? assert_predicate @params[:person], :permitted? assert_predicate @params[:person][:name], :permitted? assert_predicate @params[:person][:addresses][0], :permitted? + assert_predicate @params[:nested_array][0][0], :permitted? + assert_predicate @params[:nested_array][0][1], :permitted? end test "permitted takes a default value when Parameters.permit_all_parameters is set" do |