From 92f9ff8cc325d72d74cbf839ac9ac0acd474a768 Mon Sep 17 00:00:00 2001 From: Xavier Noria Date: Sat, 21 Dec 2013 01:11:47 +0100 Subject: converts hashes in arrays of unfiltered params to unpermitted params [fixes #13382] --- actionpack/lib/action_controller/metal/strong_parameters.rb | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'actionpack/lib') diff --git a/actionpack/lib/action_controller/metal/strong_parameters.rb b/actionpack/lib/action_controller/metal/strong_parameters.rb index b4948d99a8..a3ac15a1d2 100644 --- a/actionpack/lib/action_controller/metal/strong_parameters.rb +++ b/actionpack/lib/action_controller/metal/strong_parameters.rb @@ -330,11 +330,18 @@ module ActionController private def convert_hashes_to_parameters(key, value) - if value.is_a?(Parameters) || !value.is_a?(Hash) + converted = convert_value_to_parameters(value) + self[key] = converted unless converted.equal?(value) + converted + end + + def convert_value_to_parameters(value) + if value.is_a?(Array) + value.map { |_| convert_value_to_parameters(_) } + elsif value.is_a?(Parameters) || !value.is_a?(Hash) value else - # Convert to Parameters on first access - self[key] = self.class.new(value) + self.class.new(value) end end -- cgit v1.2.3