1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00

When executing permit with just a key that points to a hash, DO NOT allow all the hash

params.require(:person).permit(:projects_attributes) was returning
=> {"projects_attributes"=>{"0"=>{"name"=>"Project 1"}}}

When should return
=> {}

You should be doing ...
params.require(:person).permit(projects_attributes: :name)
to get just the projects attributes you want to allow
This commit is contained in:
Santiago Pastorino 2012-10-12 00:50:20 -02:00
parent b91a90e496
commit bdd105d8b9
2 changed files with 9 additions and 2 deletions

View file

@ -177,7 +177,10 @@ module ActionController
filters.each do |filter|
case filter
when Symbol, String then
params[filter] = self[filter] if has_key?(filter)
if has_key?(filter)
value = self[filter]
params[filter] = value unless Hash === value
end
keys.grep(/\A#{Regexp.escape(filter)}\(\di\)\z/) { |key| params[key] = self[key] }
when Hash then
self.slice(*filter.keys).each do |key, values|

View file

@ -15,18 +15,22 @@ class NestedParametersTest < ActiveSupport::TestCase
details: {
pages: 200,
genre: "Tragedy"
},
id: {
isbn: 'x'
}
},
magazine: "Mjallo!"
})
permitted = params.permit book: [ :title, { authors: [ :name ] }, { details: :pages } ]
permitted = params.permit book: [ :title, { authors: [ :name ] }, { details: :pages }, :id ]
assert permitted.permitted?
assert_equal "Romeo and Juliet", permitted[:book][:title]
assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
assert_equal 200, permitted[:book][:details][:pages]
assert_nil permitted[:book][:id]
assert_nil permitted[:book][:details][:genre]
assert_nil permitted[:book][:authors][0][:born]
assert_nil permitted[:magazine]