Raise ProtectedAttributeAssignmentError in development and test environments when mass-assigning to an attr_protected attribute. Closes #9699.

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7777 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

2 files changed, 21 insertions, 0 deletions

diff --git a/railties/environments/production.rb b/railties/environments/production.rb
index cb295b83f1..415a058f4c 100644
--- a/railties/environments/production.rb
+++ b/railties/environments/production.rb
@@ -16,3 +16,6 @@ config.action_controller.perform_caching             = true
 
 # Disable delivery errors, bad email addresses will be ignored
 # config.action_mailer.raise_delivery_errors = false
+
+# Disable raising errors when mass-assigning to a protected attribute
+config.whiny_protected_attributes = false
diff --git a/railties/lib/initializer.rb b/railties/lib/initializer.rb
index 0256ba96b2..b2a405d268 100644
--- a/railties/lib/initializer.rb
+++ b/railties/lib/initializer.rb
@@ -72,6 +72,7 @@ module Rails
     # * #initialize_framework_views
     # * #initialize_dependency_mechanism
     # * #initialize_whiny_nils
+    # * #initialize_whiny_protected_attributes
     # * #initialize_temporary_directories
     # * #initialize_framework_settings
     # * #add_support_load_paths
@@ -95,6 +96,7 @@ module Rails
       initialize_framework_views
       initialize_dependency_mechanism
       initialize_whiny_nils
+      initialize_whiny_protected_attributes
       initialize_temporary_directories
       initialize_framework_settings
 
@@ -298,6 +300,12 @@ module Rails
     def initialize_whiny_nils
       require('active_support/whiny_nil') if configuration.whiny_nils
     end
+    
+    # Sets +ActiveRecord::Base#whiny_protected_attributes+ which determines whether to
+    # raise on mass-assigning attributes protected with +attr_protected+/+attr_accessible+.
+    def initialize_whiny_protected_attributes
+      ActiveRecord::Base.whiny_protected_attributes = configuration.whiny_protected_attributes
+    end
 
     def initialize_temporary_directories
       if configuration.frameworks.include?(:action_controller)
@@ -423,6 +431,11 @@ module Rails
     # Set to +true+ if you want to be warned (noisily) when you try to invoke
     # any method of +nil+. Set to +false+ for the standard Ruby behavior.
     attr_accessor :whiny_nils
+    
+    # The default value of +true+ means an exception will be raised on attempts
+    # to mass-assign to protected attributes. Set to +false+ to discard them
+    # without raising (an error will be logged instead).
+    attr_accessor :whiny_protected_attributes
 
     # The list of plugins to load. If this is set to <tt>nil</tt>, all plugins will
     # be loaded. If this is set to <tt>[]</tt>, no plugins will be loaded. Otherwise,
@@ -471,6 +484,7 @@ module Rails
       self.controller_paths             = default_controller_paths
       self.cache_classes                = default_cache_classes
       self.whiny_nils                   = default_whiny_nils
+      self.whiny_protected_attributes   = default_whiny_protected_attributes
       self.plugins                      = default_plugins
       self.plugin_paths                 = default_plugin_paths
       self.plugin_locators              = default_plugin_locators
@@ -630,6 +644,10 @@ module Rails
       def default_whiny_nils
         false
       end
+      
+      def default_whiny_protected_attributes
+        true
+      end
 
       def default_plugins
         nil