From ae3286b74346023a868d63c53cde562b1529ef2c Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Tue, 8 Jan 2013 15:52:00 +0100 Subject: Never treat action or controller as unpermitted params --- .../action_controller/metal/strong_parameters.rb | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) (limited to 'actionpack/lib/action_controller') diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb index 5ea1b2cc1a..3691dc699f 100644 --- a/actionpack/lib/action_controller/metal/strong_parameters.rb +++ b/actionpack/lib/action_controller/metal/strong_parameters.rb @@ -95,6 +95,10 @@ module ActionController cattr_accessor :permit_all_parameters, instance_accessor: false cattr_accessor :raise_on_unpermitted_parameters, instance_accessor: false + # Never raise an UnpermittedParameters exception because of these params + # are present. They are added by Rails and it's of no concern. + NEVER_UNPERMITTED_PARAMS = %w( controller action ) + # Returns a new instance of ActionController::Parameters. # Also, sets the +permitted+ attribute to the default value of # ActionController::Parameters.permit_all_parameters. @@ -251,12 +255,7 @@ module ActionController end end - if Parameters.raise_on_unpermitted_parameters - unpermitted_keys = self.keys - params.keys - if unpermitted_keys.any? - raise ActionController::UnpermittedParameters.new(unpermitted_keys) - end - end + raise_on_unpermitted_parameters!(params) params.permit! end @@ -336,6 +335,16 @@ module ActionController yield object end end + + def raise_on_unpermitted_parameters!(params) + if self.class.raise_on_unpermitted_parameters && unpermitted_keys(params).any? + raise ActionController::UnpermittedParameters.new(unpermitted_keys(params)) + end + end + + def unpermitted_keys(params) + self.keys - params.keys - NEVER_UNPERMITTED_PARAMS + end end # == Strong \Parameters -- cgit v1.2.3