aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_controller/metal/strong_parameters.rb
Commit message (Collapse)AuthorAgeFilesLines
* drop conditionals in conversion logicAaron Patterson2015-07-211-7/+5
| | | | | | | there is no reason to `convert_hashes_to_parameters` with an assignemt flag. The caller knows whether or not it wants the value assigned. We should just change the uncommon case (not writing to the underlying hash) to just call the conversion method and return that value.
* rearrange logic to use positive branchesAaron Patterson2015-07-211-4/+6
| | | | | | only hashes are converted to parameter objects, so lets add a branch for them. This also removes a is_a? test for Parameters so we can be abstracted from the class.
* Fix exception overwritten for parameters fetch methodRoque Pinel2015-07-181-3/+7
| | | | | | | | | When executing an `ActionController::Parameters#fetch` with a block that raises a `KeyError` the raised `KeyError` will be rescued and converted to an `ActionController::ParameterMissing` exception, covering up the original exception. [Jonas Schubert Erlandsson & Roque Pinel]
* push fields_for_style? in to a protected methodAaron Patterson2015-07-171-5/+5
| | | | | this way we don't need to call `to_unsafe_h` to get access to ask questions about the underlying hash
* push is_a checks up the stackAaron Patterson2015-07-171-13/+13
| | | | now `hash_filter` doesn't need to know about the `Parameters` class
* remove useless conditionalAaron Patterson2015-07-171-1/+0
| | | | | Since we proved that `element` is always of type `Parameter`, we know that it will always respond to `permit`, so lets remove this conditional
* remove useless conditionalsAaron Patterson2015-07-171-2/+2
| | | | | | | | `element` can never be a hash because: 1. `slice` returns a Parameters object and calls each on it: https://github.com/rails/rails/blob/cb3f25593b1137e344086364d4b1a52c08e8eb3b/actionpack/lib/action_controller/metal/strong_parameters.rb#L656 2. `each` which is implemented by `each_pair` will call `convert_hashes_to_parameters` on the value: https://github.com/rails/rails/blob/cb3f25593b1137e344086364d4b1a52c08e8eb3b/actionpack/lib/action_controller/metal/strong_parameters.rb#L192-197 3. `convert_hashes_to_parameters` will convert any hash objects in to parameters objects: https://github.com/rails/rails/blob/cb3f25593b1137e344086364d4b1a52c08e8eb3b/actionpack/lib/action_controller/metal/strong_parameters.rb#L550-566
* remove useless functionAaron Patterson2015-07-171-8/+2
| | | | | | Now that the value is cached on the stack, `array_of_permitted_scalars_filter` is exactly the same as `array_of_permitted_scalars?`, so lets just have one
* stop passing `params` to `array_of_permitted_scalars_filter`Aaron Patterson2015-07-171-4/+6
| | | | | | this way the method doesn't have to know what the new params object is, it just yields to a block. This change also caches the value of `self[key]` on the stack
* push key checking upAaron Patterson2015-07-171-1/+2
| | | | | | We should disconnect `array_of_permitted_scalars_filter` from the instance so that we can make hash filtering functional. For now, pull the conditional up out of that method
* Standardize `ActionController::Parameters#to_unsafe_h` return valueZoltan Kiss2015-07-151-1/+1
| | | | | | `ActionController::Parameters#to_h` returns a hash, so lets have `ActionController::Parameters#to_unsafe_h` return a hash instead of an `ActiveSupport::HashWithIndifferentAccess` for consistency.
* Update documentation on `AC::Parameters`Prem Sichanugrist2015-07-151-6/+32
|
* Make AC::Parameters not inherited from HashPrem Sichanugrist2015-07-151-28/+99
| | | | | | | | This is another take at #14384 as we decided to wait until `master` is targeting Rails 5.0. This commit is implementation-complete, as it guarantees that all the public methods on the hash-inherited Parameters are still working (based on test case). We can decide to follow-up later if we want to remove some methods out from Parameters.
* Merge pull request #20659 from ↵Yves Senn2015-06-221-2/+4
|\ | | | | | | | | | | vngrs/strong_parameters_unpermitted_parameters_wrong_doc_fix Fix the documentation about ActionController::UnpermittedParameters [ci skip]
| * Fix the documentation about ActionController::UnpermittedParameters [ci skip]Mehmet Emin İNAÇ2015-06-221-2/+4
|/
* Fix the documentation about ActionController::ParameterMissing [ci skip]Mehmet Emin İNAÇ2015-06-221-5/+5
|
* fix missing "if" in API docs for ActionController::Parameters#permitMichael Josephson2015-04-061-1/+1
|
* Return super in ActionController::Parameters.const_missingShuhei Kagawa2015-03-281-1/+1
| | | | | | | | | | | | | | | | | | | | | The current implementation of ActionController::Parameters.const_missing returns `ActionController::Parameters.always_permitted_parameters` even if its `super` returns a constant without raising error. This prevents its subclass in a autoloading module/class from taking advantage of autoloading constants. class SomeParameters < ActionController::Parameters def do_something DefinedSomewhere.do_something end end In the code above, `DefinedSomewhere` is to be autoloaded with `Module.const_missing` but `ActionController::Parameters.const_missing` returns `always_permitted_parameters` instead of the autoloaded constant. This pull request fixes the issue respecting `const_missing`'s `super`.
* Removed non-standard and unused require 'active_support/deprecation' from ↵Vipul A M2015-02-271-1/+0
| | | | parts out of active_support.
* Revert "Merge pull request #18003 from ↵Godfrey Chan2014-12-191-11/+6
| | | | | | | | | | sikachu/permit_all_parameters-thread-safety" This reverts commit da5cc10e945552da54234f858470238a3fc36767. Fixes #18091 See also https://github.com/rails/rails/pull/18003#commitcomment-9030909
* Merge pull request #18006 from sikachu/add-params-to_unsafe_hRafael Mendonça França2014-12-121-0/+6
|\ | | | | Add AC::Parameters#to_unsafe_h
| * Add AC::Parameters#to_unsafe_hPrem Sichanugrist2014-12-121-0/+6
| | | | | | | | | | | | | | | | | | As suggested in #16299([1]), this method should be a new public API for retrieving unfiltered parameters from `ActionController::Parameters` object, given that `Parameters#to_hash` will no longer work in Rails 5.0+ as we stop inheriting `Parameters` from `Hash`. [1]: https://github.com/rails/rails/pull/16299#issuecomment-50220919
* | Make AC::Params.permit_all_parameters thread safePrem Sichanugrist2014-12-121-1/+10
|/ | | | | | | As discussed in #16299[1], this attribute is not thread safe and could potentially create a security issue. [1]: https://github.com/rails/rails/pull/16299#discussion_r15424533
* let's warn with heredocsXavier Noria2014-10-281-4/+7
| | | | | | | | | | | | The current style for warning messages without newlines uses concatenation of string literals with manual trailing spaces where needed. Heredocs have better readability, and with `squish` we can still produce a single line. This is a similar use case to the one that motivated defining `strip_heredoc`, heredocs are super clean.
* User `#to_hash` instead of calling `super`Prem Sichanugrist2014-08-181-1/+1
| | | | Ruby 1.9.3 does not implement Hash#to_h, so we can't call `super` on it.
* Fix failing test on several methods on ParameterPrem Sichanugrist2014-08-181-1/+25
| | | | | | | * `each` * `each_pair` * `delete` * `select!`
* Refactor code to reduce duplicate `self.class.new`Prem Sichanugrist2014-08-181-12/+10
|
* Add missing `Hash` methods to `AC::Parameters`Prem Sichanugrist2014-08-181-0/+40
| | | | | | | | | | | | This is to make sure that `permitted` status is maintained on the resulting object. I found these methods that needs to be redefined by looking for `self.class.new` in the code. * extract! * transform_keys * transform_values
* Make `AC::Params#to_h` return Hash with safe keysPrem Sichanugrist2014-08-181-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | `ActionController::Parameters#to_h` now returns a `Hash` with unpermitted keys removed. This change is to reflect on a security concern where some method performed on an `ActionController::Parameters` may yield a `Hash` object which does not maintain `permitted?` status. If you would like to get a `Hash` with all the keys intact, duplicate and mark it as permitted before calling `#to_h`. params = ActionController::Parameters.new(name: 'Senjougahara Hitagi') params.to_h # => {} unsafe_params = params.dup.permit! unsafe_params.to_h # => {"name"=>"Senjougahara Hitagi"} safe_params = params.permit(:name) safe_params.to_h # => {"name"=>"Senjougahara Hitagi"} This change is consider a stopgap as we cannot chage the code to stop `ActionController::Parameters` to inherit from `HashWithIndifferentAccess` in the next minor release. Also, adding a CHANGELOG entry to mention that `ActionController::Parameters` will not inheriting from `HashWithIndifferentAccess` in the next major version.
* Merge pull request #15933 from rafael/masterRafael Mendonça França2014-06-271-5/+20
|\ | | | | | | | | | | Add always permitted parameters as a configurable option. [Rafael Mendonça França + Gary S. Weaver]
| * Improvements per code review.Rafael Chacón2014-06-271-4/+3
| | | | | | | | | | | | * General style fixes. * Add changes to configuration guide. * Add missing tests.
| * Add always_permitted_parameters as an option.Rafael Chacón2014-06-261-5/+21
| | | | | | | | | | | | | | | | | | * This commit adds back the always_permitted_parameters configuration option to strong paramaters. * The initial pull requests where this feature was added are the following: - https://github.com/rails/rails/pull/12682 - https://github.com/rails/strong_parameters/pull/174
* | Merge pull request #15692 from sromano/falseClassMatthew Draper2014-06-141-1/+6
|\ \ | | | | | | | | | ActionController::Parameters#require now accepts FalseClass values
| * | ActionController::Parameters#require now accepts FalseClass valuesSergio Romano2014-06-131-0/+1
|/ / | | | | | | Fixes #15685.
* | adds some details to the rationale of converted_arrays [ci skip]Xavier Noria2014-06-071-0/+4
| |
* | Revert "Convert StrongParameters cache to a hash. This fixes an unbounded"Xavier Noria2014-06-071-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We cannot cache keys because arrays are mutable. We rather want to cache the arrays. This behaviour is tailor-made for the usage pattern strongs params is designed for. In a forthcoming commit I am going to add a test that covers why we need to cache by value. Every strong params instance has a live span of a request, the cache goes away with the object. Since strong params have such a concrete intention, it would be interesting to see if there are actually any real-world use cases that are an actual leak, one that practically may matter. I am not convinced that the theoretical leak has any practical consequences, but if it can be shown there are, then I believe we should either get rid of the cache (which is an optimization), or else wipe it in the mutating API. This reverts commit e63be2769c039e4e9ada523a8497ce3206cc8a9b.
* | Avoid misuse of underscore argumentCorey Ward2014-06-051-2/+2
| | | | | | Per convention, underscore-only argument names should be used for unused parameters.
* | Convert StrongParameters cache to a hash. This fixes an unboundedRyan Davis2014-06-031-6/+6
| | | | | | | | | | | | memory leak demonstrated on @tenderlove's latest blog post: http://tenderlovemaking.com/2014/06/02/yagni-methods-are-killing-me.html
* | Tiny doc fix for Strong ParametersIan C. Anderson2014-03-301-1/+1
| | | | | | - accepts_nested_attribute_for -> accepts_nested_attributes_for
* | Simple Sungularize ActionController::UnpermittedParameters error in case ↵Serj L2014-02-241-1/+1
| | | | | | | | when only 1 parameter is unpermitted.
* | AC::Parameters#permit! permits hashes in array valuesXavier Noria2013-12-231-2/+4
| |
* | optimizes array conversion in AC::ParametersXavier Noria2013-12-211-2/+12
| |
* | refactors AC::Parameters#fetchXavier Noria2013-12-211-10/+3
| | | | | | | | | | | | | | | | AC::Parameters#fetch was refactored in 7171111 to prevent self mutation, but in doing so it hardcodes logic #convert_hashes_to_parameters is supposed to encapsulate. Better leave the delegation, and add a way to avoid mutating self in there.
* | converts hashes in arrays of unfiltered params to unpermitted params [fixes ↵Xavier Noria2013-12-211-3/+10
| | | | | | | | #13382]
* | Improve wording in AC::ParameterMissing error messageGuillermo Iguaran2013-11-021-1/+1
| |
* | Revert "Merge pull request #9660 from ↵Guillermo Iguaran2013-11-021-23/+9
| | | | | | | | | | | | | | | | | | sebasoga/change_strong_parameters_require_behaviour" This reverts commit c2b5a8e61ba0f35015e6ac949a5c8fce2042a1f2, reversing changes made to 1918b12c0429caec2a6134ac5e5b42ade103fe90. See: https://github.com/rails/rails/pull/9660#issuecomment-27627493
* | Merge pull request #9660 from ↵Guillermo Iguaran2013-11-011-9/+23
|\ \ | | | | | | | | | | | | sebasoga/change_strong_parameters_require_behaviour Change ActionController::Parameters#require behavior when value is empty
| * | Change ActionController::Parameters#require behavior when value is emptySebastian Sogamoso2013-03-111-9/+23
| | | | | | | | | | | | | | | When the value for the required key is empty an ActionController::ParameterMissing is raised which gets caught by ActionController::Base and turned into a 400 Bad Request reply with a message in the body saying the key is missing, which is misleading. With these changes, ActionController::EmptyParameter will be raised which ActionController::Base will catch and turn into a 400 Bad Request reply with a message in the body saying the key value is empty.
* | | don't mutate hash with fetchDoug Cole2013-10-261-1/+8
| |/ |/|
* | Strong parameters should permit nested number as key. Closes #12293kennyj2013-09-271-1/+5
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 12:44:16 +0000