Merge pull request #7251 from rails/integrate-strong_parameters

Integrate strong_parameters in Rails 4

7 files changed, 31 insertions, 48 deletions

diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb
index 428c90afd0..d014e5e362 100644
--- a/railties/test/application/configuration_test.rb
+++ b/railties/test/application/configuration_test.rb
@@ -358,19 +358,6 @@ module ApplicationTests
       assert_equal "utf-16", ActionDispatch::Response.default_charset
     end
 
-    test "sets all Active Record models to whitelist all attributes by default" do
-      add_to_config <<-RUBY
-        config.active_record.whitelist_attributes = true
-      RUBY
-
-      require "#{app_path}/config/environment"
-
-      klass = Class.new(ActiveRecord::Base)
-
-      assert_equal ActiveModel::MassAssignmentSecurity::WhiteList, klass.active_authorizers[:default].class
-      assert_equal [], klass.active_authorizers[:default].to_a
-    end
-
     test "registers interceptors with ActionMailer" do
       add_to_config <<-RUBY
         config.action_mailer.interceptors = MyMailInterceptor
@@ -595,6 +582,28 @@ module ApplicationTests
       assert_equal '{"title"=>"foo"}', last_response.body
     end
 
+    test "config.action_controller.permit_all_parameters = true" do
+      app_file 'app/controllers/posts_controller.rb', <<-RUBY
+      class PostsController < ActionController::Base
+        def create
+          render :text => params[:post].permitted? ? "permitted" : "forbidden"
+        end
+      end
+      RUBY
+
+      add_to_config <<-RUBY
+        routes.prepend do
+          resources :posts
+        end
+        config.action_controller.permit_all_parameters = true
+      RUBY
+
+      require "#{app_path}/config/environment"
+
+      post "/posts", {:post => {"title" =>"zomg"}}
+      assert_equal 'permitted', last_response.body
+    end
+
     test "config.action_dispatch.ignore_accept_header" do
       make_basic_app do |app|
         app.config.action_dispatch.ignore_accept_header = true
diff --git a/railties/test/application/loading_test.rb b/railties/test/application/loading_test.rb
index e0286502f3..fcbc3c048c 100644
--- a/railties/test/application/loading_test.rb
+++ b/railties/test/application/loading_test.rb
@@ -20,7 +20,6 @@ class LoadingTest < ActiveSupport::TestCase
     app_file "app/models/post.rb", <<-MODEL
       class Post < ActiveRecord::Base
         validates_acceptance_of :title, :accept => "omg"
-        attr_accessible :title
       end
     MODEL
 
diff --git a/railties/test/generators/app_generator_test.rb b/railties/test/generators/app_generator_test.rb
index 3ceb8c22a0..e7b6a20b32 100644
--- a/railties/test/generators/app_generator_test.rb
+++ b/railties/test/generators/app_generator_test.rb
@@ -212,7 +212,6 @@ class AppGeneratorTest < Rails::Generators::TestCase
     run_generator [destination_root, "--skip-active-record"]
     assert_no_file "config/database.yml"
     assert_file "config/application.rb", /#\s+require\s+["']active_record\/railtie["']/
-    assert_file "config/application.rb", /#\s+config\.active_record\.whitelist_attributes = true/
     assert_file "test/test_helper.rb" do |helper_content|
       assert_no_match(/fixtures :all/, helper_content)
     end
@@ -343,15 +342,6 @@ class AppGeneratorTest < Rails::Generators::TestCase
     end
   end
 
-  def test_generated_environments_file_for_sanitizer
-    run_generator [destination_root, "--skip-active-record"]
-    %w(development test).each do |env|
-      assert_file "config/environments/#{env}.rb" do |file|
-        assert_no_match(/config.active_record.mass_assignment_sanitizer = :strict/, file)
-      end
-    end
-  end
-
   def test_generated_environments_file_for_auto_explain
     run_generator [destination_root, "--skip-active-record"]
     %w(development production).each do |env|
@@ -361,11 +351,6 @@ class AppGeneratorTest < Rails::Generators::TestCase
     end
   end
 
-  def test_active_record_whitelist_attributes_is_present_application_config
-    run_generator
-    assert_file "config/application.rb", /config\.active_record\.whitelist_attributes = true/
-  end
-
   def test_pretend_option
     output = run_generator [File.join(destination_root, "myapp"), "--pretend"]
     assert_no_match(/run  bundle install/, output)
diff --git a/railties/test/generators/model_generator_test.rb b/railties/test/generators/model_generator_test.rb
index ec33bd7c6b..436de26826 100644
--- a/railties/test/generators/model_generator_test.rb
+++ b/railties/test/generators/model_generator_test.rb
@@ -328,14 +328,4 @@ class ModelGeneratorTest < Rails::Generators::TestCase
       end
     end
   end
-
-  def test_attr_accessible_added_with_non_reference_attributes
-    run_generator
-    assert_file 'app/models/account.rb', /attr_accessible :age, :name/
-  end
-
-  def test_attr_accessible_added_with_comments_when_no_attributes_present
-    run_generator ["Account"]
-    assert_file 'app/models/account.rb', /# attr_accessible :title, :body/
-  end
 end
diff --git a/railties/test/generators/scaffold_controller_generator_test.rb b/railties/test/generators/scaffold_controller_generator_test.rb
index 1eea50b0d9..1e16f04d85 100644
--- a/railties/test/generators/scaffold_controller_generator_test.rb
+++ b/railties/test/generators/scaffold_controller_generator_test.rb
@@ -33,14 +33,14 @@ class ScaffoldControllerGeneratorTest < Rails::Generators::TestCase
       end
 
       assert_instance_method :create, content do |m|
-        assert_match(/@user = User\.new\(params\[:user\]\)/, m)
+        assert_match(/@user = User\.new\(user_params\)/, m)
         assert_match(/@user\.save/, m)
         assert_match(/@user\.errors/, m)
       end
 
       assert_instance_method :update, content do |m|
         assert_match(/@user = User\.find\(params\[:id\]\)/, m)
-        assert_match(/@user\.update_attributes\(params\[:user\]\)/, m)
+        assert_match(/@user\.update_attributes\(user_params\)/, m)
         assert_match(/@user\.errors/, m)
       end
 
@@ -48,6 +48,9 @@ class ScaffoldControllerGeneratorTest < Rails::Generators::TestCase
         assert_match(/@user = User\.find\(params\[:id\]\)/, m)
         assert_match(/@user\.destroy/, m)
       end
+
+      assert_match(/def user_params/, content)
+      assert_match(/params\.require\(:user\)\.permit\(:age, :name\)/, content)
     end
   end
 
diff --git a/railties/test/generators/scaffold_generator_test.rb b/railties/test/generators/scaffold_generator_test.rb
index 9b456c64ef..40c5188042 100644
--- a/railties/test/generators/scaffold_generator_test.rb
+++ b/railties/test/generators/scaffold_generator_test.rb
@@ -43,14 +43,14 @@ class ScaffoldGeneratorTest < Rails::Generators::TestCase
       end
 
       assert_instance_method :create, content do |m|
-        assert_match(/@product_line = ProductLine\.new\(params\[:product_line\]\)/, m)
+        assert_match(/@product_line = ProductLine\.new\(product_line_params\)/, m)
         assert_match(/@product_line\.save/, m)
         assert_match(/@product_line\.errors/, m)
       end
 
       assert_instance_method :update, content do |m|
         assert_match(/@product_line = ProductLine\.find\(params\[:id\]\)/, m)
-        assert_match(/@product_line\.update_attributes\(params\[:product_line\]\)/, m)
+        assert_match(/@product_line\.update_attributes\(product_line_params\)/, m)
         assert_match(/@product_line\.errors/, m)
       end
 
@@ -166,14 +166,14 @@ class ScaffoldGeneratorTest < Rails::Generators::TestCase
       end
 
       assert_instance_method :create, content do |m|
-        assert_match(/@admin_role = Admin::Role\.new\(params\[:admin_role\]\)/, m)
+        assert_match(/@admin_role = Admin::Role\.new\(admin_role_params\)/, m)
         assert_match(/@admin_role\.save/, m)
         assert_match(/@admin_role\.errors/, m)
       end
 
       assert_instance_method :update, content do |m|
         assert_match(/@admin_role = Admin::Role\.find\(params\[:id\]\)/, m)
-        assert_match(/@admin_role\.update_attributes\(params\[:admin_role\]\)/, m)
+        assert_match(/@admin_role\.update_attributes\(admin_role_params\)/, m)
         assert_match(/@admin_role\.errors/, m)
       end
 
diff --git a/railties/test/isolation/abstract_unit.rb b/railties/test/isolation/abstract_unit.rb
index 07a7faa3af..0f36eb67e5 100644
--- a/railties/test/isolation/abstract_unit.rb
+++ b/railties/test/isolation/abstract_unit.rb
@@ -253,9 +253,6 @@ module TestHelpers
     def use_frameworks(arr)
       to_remove =  [:actionmailer,
                     :activerecord] - arr
-      if to_remove.include? :activerecord
-        remove_from_config "config.active_record.whitelist_attributes = true"
-      end
       $:.reject! {|path| path =~ %r'/(#{to_remove.join('|')})/' }
     end