aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_controller/metal/strong_parameters.rb
Commit message (Collapse)AuthorAgeFilesLines
* Revert "Merge pull request #18003 from ↵Godfrey Chan2014-12-191-11/+6
| | | | | | | | | | sikachu/permit_all_parameters-thread-safety" This reverts commit da5cc10e945552da54234f858470238a3fc36767. Fixes #18091 See also https://github.com/rails/rails/pull/18003#commitcomment-9030909
* Merge pull request #18006 from sikachu/add-params-to_unsafe_hRafael Mendonça França2014-12-121-0/+6
|\ | | | | Add AC::Parameters#to_unsafe_h
| * Add AC::Parameters#to_unsafe_hPrem Sichanugrist2014-12-121-0/+6
| | | | | | | | | | | | | | | | | | As suggested in #16299([1]), this method should be a new public API for retrieving unfiltered parameters from `ActionController::Parameters` object, given that `Parameters#to_hash` will no longer work in Rails 5.0+ as we stop inheriting `Parameters` from `Hash`. [1]: https://github.com/rails/rails/pull/16299#issuecomment-50220919
* | Make AC::Params.permit_all_parameters thread safePrem Sichanugrist2014-12-121-1/+10
|/ | | | | | | As discussed in #16299[1], this attribute is not thread safe and could potentially create a security issue. [1]: https://github.com/rails/rails/pull/16299#discussion_r15424533
* let's warn with heredocsXavier Noria2014-10-281-4/+7
| | | | | | | | | | | | The current style for warning messages without newlines uses concatenation of string literals with manual trailing spaces where needed. Heredocs have better readability, and with `squish` we can still produce a single line. This is a similar use case to the one that motivated defining `strip_heredoc`, heredocs are super clean.
* User `#to_hash` instead of calling `super`Prem Sichanugrist2014-08-181-1/+1
| | | | Ruby 1.9.3 does not implement Hash#to_h, so we can't call `super` on it.
* Fix failing test on several methods on ParameterPrem Sichanugrist2014-08-181-1/+25
| | | | | | | * `each` * `each_pair` * `delete` * `select!`
* Refactor code to reduce duplicate `self.class.new`Prem Sichanugrist2014-08-181-12/+10
|
* Add missing `Hash` methods to `AC::Parameters`Prem Sichanugrist2014-08-181-0/+40
| | | | | | | | | | | | This is to make sure that `permitted` status is maintained on the resulting object. I found these methods that needs to be redefined by looking for `self.class.new` in the code. * extract! * transform_keys * transform_values
* Make `AC::Params#to_h` return Hash with safe keysPrem Sichanugrist2014-08-181-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | `ActionController::Parameters#to_h` now returns a `Hash` with unpermitted keys removed. This change is to reflect on a security concern where some method performed on an `ActionController::Parameters` may yield a `Hash` object which does not maintain `permitted?` status. If you would like to get a `Hash` with all the keys intact, duplicate and mark it as permitted before calling `#to_h`. params = ActionController::Parameters.new(name: 'Senjougahara Hitagi') params.to_h # => {} unsafe_params = params.dup.permit! unsafe_params.to_h # => {"name"=>"Senjougahara Hitagi"} safe_params = params.permit(:name) safe_params.to_h # => {"name"=>"Senjougahara Hitagi"} This change is consider a stopgap as we cannot chage the code to stop `ActionController::Parameters` to inherit from `HashWithIndifferentAccess` in the next minor release. Also, adding a CHANGELOG entry to mention that `ActionController::Parameters` will not inheriting from `HashWithIndifferentAccess` in the next major version.
* Merge pull request #15933 from rafael/masterRafael Mendonça França2014-06-271-5/+20
|\ | | | | | | | | | | Add always permitted parameters as a configurable option. [Rafael Mendonça França + Gary S. Weaver]
| * Improvements per code review.Rafael Chacón2014-06-271-4/+3
| | | | | | | | | | | | * General style fixes. * Add changes to configuration guide. * Add missing tests.
| * Add always_permitted_parameters as an option.Rafael Chacón2014-06-261-5/+21
| | | | | | | | | | | | | | | | | | * This commit adds back the always_permitted_parameters configuration option to strong paramaters. * The initial pull requests where this feature was added are the following: - https://github.com/rails/rails/pull/12682 - https://github.com/rails/strong_parameters/pull/174
* | Merge pull request #15692 from sromano/falseClassMatthew Draper2014-06-141-1/+6
|\ \ | | | | | | | | | ActionController::Parameters#require now accepts FalseClass values
| * | ActionController::Parameters#require now accepts FalseClass valuesSergio Romano2014-06-131-0/+1
|/ / | | | | | | Fixes #15685.
* | adds some details to the rationale of converted_arrays [ci skip]Xavier Noria2014-06-071-0/+4
| |
* | Revert "Convert StrongParameters cache to a hash. This fixes an unbounded"Xavier Noria2014-06-071-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We cannot cache keys because arrays are mutable. We rather want to cache the arrays. This behaviour is tailor-made for the usage pattern strongs params is designed for. In a forthcoming commit I am going to add a test that covers why we need to cache by value. Every strong params instance has a live span of a request, the cache goes away with the object. Since strong params have such a concrete intention, it would be interesting to see if there are actually any real-world use cases that are an actual leak, one that practically may matter. I am not convinced that the theoretical leak has any practical consequences, but if it can be shown there are, then I believe we should either get rid of the cache (which is an optimization), or else wipe it in the mutating API. This reverts commit e63be2769c039e4e9ada523a8497ce3206cc8a9b.
* | Avoid misuse of underscore argumentCorey Ward2014-06-051-2/+2
| | | | | | Per convention, underscore-only argument names should be used for unused parameters.
* | Convert StrongParameters cache to a hash. This fixes an unboundedRyan Davis2014-06-031-6/+6
| | | | | | | | | | | | memory leak demonstrated on @tenderlove's latest blog post: http://tenderlovemaking.com/2014/06/02/yagni-methods-are-killing-me.html
* | Tiny doc fix for Strong ParametersIan C. Anderson2014-03-301-1/+1
| | | | | | - accepts_nested_attribute_for -> accepts_nested_attributes_for
* | Simple Sungularize ActionController::UnpermittedParameters error in case ↵Serj L2014-02-241-1/+1
| | | | | | | | when only 1 parameter is unpermitted.
* | AC::Parameters#permit! permits hashes in array valuesXavier Noria2013-12-231-2/+4
| |
* | optimizes array conversion in AC::ParametersXavier Noria2013-12-211-2/+12
| |
* | refactors AC::Parameters#fetchXavier Noria2013-12-211-10/+3
| | | | | | | | | | | | | | | | AC::Parameters#fetch was refactored in 7171111 to prevent self mutation, but in doing so it hardcodes logic #convert_hashes_to_parameters is supposed to encapsulate. Better leave the delegation, and add a way to avoid mutating self in there.
* | converts hashes in arrays of unfiltered params to unpermitted params [fixes ↵Xavier Noria2013-12-211-3/+10
| | | | | | | | #13382]
* | Improve wording in AC::ParameterMissing error messageGuillermo Iguaran2013-11-021-1/+1
| |
* | Revert "Merge pull request #9660 from ↵Guillermo Iguaran2013-11-021-23/+9
| | | | | | | | | | | | | | | | | | sebasoga/change_strong_parameters_require_behaviour" This reverts commit c2b5a8e61ba0f35015e6ac949a5c8fce2042a1f2, reversing changes made to 1918b12c0429caec2a6134ac5e5b42ade103fe90. See: https://github.com/rails/rails/pull/9660#issuecomment-27627493
* | Merge pull request #9660 from ↵Guillermo Iguaran2013-11-011-9/+23
|\ \ | | | | | | | | | | | | sebasoga/change_strong_parameters_require_behaviour Change ActionController::Parameters#require behavior when value is empty
| * | Change ActionController::Parameters#require behavior when value is emptySebastian Sogamoso2013-03-111-9/+23
| | | | | | | | | | | | | | | When the value for the required key is empty an ActionController::ParameterMissing is raised which gets caught by ActionController::Base and turned into a 400 Bad Request reply with a message in the body saying the key is missing, which is misleading. With these changes, ActionController::EmptyParameter will be raised which ActionController::Base will catch and turn into a 400 Bad Request reply with a message in the body saying the key value is empty.
* | | don't mutate hash with fetchDoug Cole2013-10-261-1/+8
| |/ |/|
* | Strong parameters should permit nested number as key. Closes #12293kennyj2013-09-271-1/+5
| |
* | do not break params filtering on nil valuesVasiliy Ermolovich2013-09-071-1/+1
| | | | | | | | closes #12149
* | Stop messing up with instance variables, use protected as it was meant forCarlos Antonio da Silva2013-08-301-2/+7
| |
* | Added data for permit array into scalar valueRahul P. Chaudhari2013-08-051-0/+1
| |
* | fixed missing comma in exampleIlya Vorontsov2013-04-241-1/+1
| |
* | Fix some typosVipul A M2013-03-241-1/+1
| |
* | Fix documentation markup [ci skip]Rafael Mendonça França2013-03-231-0/+2
| |
* | StringIO is not required by default in JRubyArun Agrawal2013-03-221-0/+1
|/
* Use the instrumentation framework to instrument Strong ParamsDaniel Schierbeck2013-03-071-1/+2
|
* Rack::Test::UploadedFile is a permitted scalarFabio Kreusch2013-02-211-3/+4
|
* ActionDispatch::Http::UploadedFile is a permitted scalar [Closes #9051]Xavier Noria2013-01-231-2/+5
|
* Only check for unpermmited parameters ifRafael Mendonça França2013-01-221-1/+1
| | | | action_on_unpermitted_parameters is present
* avoid creating an object in every callXavier Noria2013-01-221-1/+2
| | | | This was a suggestion of @carlosantoniodasilva, thanks!
* Refactor grep call to remove .eachCarlos Antonio da Silva2013-01-201-1/+1
| | | | Grep already yields the matching keys to the given block.
* Use 1.9 hash style in docs/comments [ci skip]Carlos Antonio da Silva2013-01-201-3/+3
|
* Removing warning: shadowing outer local variable Arun Agrawal2013-01-201-3/+3
|
* strong parameters filters permitted scalarsXavier Noria2013-01-201-22/+92
|
* Restore and adapt the implementation reverted atRafael Mendonça França2013-01-191-19/+46
| | | | | | https://github.com/rails/rails/commit/cc1c3c5be061e7572018f734e5239750ab449e3f Now instead of raise, we log by default in development and test
* Added ability to raise or log on unpermitted params.Thomas Drake-Brockman2013-01-201-0/+25
|
* strong parameters exception handlingBrian Alexander2013-01-151-6/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 18:11:49 +0000