1 files changed, 23 insertions, 2 deletions
diff --git a/activerecord/lib/active_record/attribute_assignment.rb b/activerecord/lib/active_record/attribute_assignment.rb
index bf9fe70b31..df4de8ac35 100644
--- a/activerecord/lib/active_record/attribute_assignment.rb
+++ b/activerecord/lib/active_record/attribute_assignment.rb
@@ -1,11 +1,25 @@
 require 'active_support/concern'
 
 module ActiveRecord
+  ActiveSupport.on_load(:active_record_config) do
+    mattr_accessor :whitelist_attributes,      instance_accessor: false
+    mattr_accessor :mass_assignment_sanitizer, instance_accessor: false
+  end
+
   module AttributeAssignment
     extend ActiveSupport::Concern
     include ActiveModel::MassAssignmentSecurity
 
+    included do
+      initialize_mass_assignment_sanitizer
+    end
+
     module ClassMethods
+      def inherited(child) # :nodoc:
+        child.send :initialize_mass_assignment_sanitizer if self == Base
+        super
+      end
+
       private
 
       # The primary key and inheritance column can never be set by mass-assignment for security reasons.
@@ -14,6 +28,11 @@ module ActiveRecord
         default << 'id' unless primary_key.eql? 'id'
         default
       end
+
+      def initialize_mass_assignment_sanitizer
+        attr_accessible(nil) if Model.whitelist_attributes
+        self.mass_assignment_sanitizer = Model.mass_assignment_sanitizer if Model.mass_assignment_sanitizer
+      end
     end
 
     # Allows you to set all the attributes at once by passing in a hash with keys
@@ -64,11 +83,12 @@ module ActiveRecord
     #   user.name       # => "Josh"
     #   user.is_admin?  # => true
     def assign_attributes(new_attributes, options = {})
-      return unless new_attributes
+      return if new_attributes.blank?
 
       attributes = new_attributes.stringify_keys
       multi_parameter_attributes = []
       nested_parameter_attributes = []
+      previous_options = @mass_assignment_options
       @mass_assignment_options = options
 
       unless options[:without_protection]
@@ -94,8 +114,9 @@ module ActiveRecord
         send("#{k}=", v)
       end
 
-      @mass_assignment_options = nil
       assign_multiparameter_attributes(multi_parameter_attributes)
+    ensure
+      @mass_assignment_options = previous_options
     end
 
     protected