1 files changed, 31 insertions, 18 deletions
diff --git a/actionpack/lib/abstract_controller/rendering.rb b/actionpack/lib/abstract_controller/rendering.rb
index 5514213ad8..d339580435 100644
--- a/actionpack/lib/abstract_controller/rendering.rb
+++ b/actionpack/lib/abstract_controller/rendering.rb
@@ -1,8 +1,7 @@
-require 'active_support/concern'
-require 'active_support/core_ext/class/attribute'
-require 'action_view'
-require 'action_view/view_paths'
-require 'set'
+require "abstract_controller/error"
+require "action_view"
+require "action_view/view_paths"
+require "set"
 
 module AbstractController
   class DoubleRenderError < Error
@@ -22,9 +21,13 @@ module AbstractController
     # :api: public
     def render(*args, &block)
       options = _normalize_render(*args, &block)
-      self.response_body = render_to_body(options)
-      _process_format(rendered_format, options) if rendered_format
-      self.response_body
+      rendered_body = render_to_body(options)
+      if options[:html]
+        _set_html_content_type
+      else
+        _set_rendered_content_type rendered_format
+      end
+      self.response_body = rendered_body
     end
 
     # Raw rendering of a template to a string.
@@ -51,14 +54,12 @@ module AbstractController
     # Returns Content-Type of rendered content
     # :api: public
     def rendered_format
-      Mime::TEXT
+      Mime[:text]
     end
 
-    DEFAULT_PROTECTED_INSTANCE_VARIABLES = Set.new %w(
-      @_action_name @_response_body @_formats @_prefixes @_config
-      @_view_context_class @_view_renderer @_lookup_context
-      @_routes @_db_runtime
-    ).map(&:to_sym)
+    DEFAULT_PROTECTED_INSTANCE_VARIABLES = Set.new %i(
+      @_action_name @_response_body @_formats @_prefixes
+    )
 
     # This method should return a hash with assigns.
     # You can overwrite this configuration per controller.
@@ -77,8 +78,14 @@ module AbstractController
     # <tt>render :action => "foo"</tt> and <tt>render "foo/bar"</tt> to
     # <tt>render :file => "foo/bar"</tt>.
     # :api: plugin
-    def _normalize_args(action=nil, options={})
-      if action.is_a? Hash
+    def _normalize_args(action = nil, options = {})
+      if action.respond_to?(:permitted?)
+        if action.permitted?
+          action
+        else
+          raise ArgumentError, "render parameters are not permitted"
+        end
+      elsif action.is_a?(Hash)
         action
       else
         options
@@ -99,7 +106,13 @@ module AbstractController
 
     # Process the rendered format.
     # :api: private
-    def _process_format(format, options = {})
+    def _process_format(format)
+    end
+
+    def _set_html_content_type # :nodoc:
+    end
+
+    def _set_rendered_content_type(format) # :nodoc:
     end
 
     # Normalize args and options.
@@ -107,7 +120,7 @@ module AbstractController
     def _normalize_render(*args, &block)
       options = _normalize_args(*args, &block)
       #TODO: remove defined? when we restore AP <=> AV dependency
-      if defined?(request) && request && request.variant.present?
+      if defined?(request) && !request.nil? && request.variant.present?
         options[:variant] = request.variant
       end
       _normalize_options(options)