1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
rails--rails/activemodel/test/cases/forbidden_attributes_protection_test.rb
2012-09-16 23:58:21 -05:00

36 lines
1 KiB
Ruby

require 'cases/helper'
require 'active_support/core_ext/hash/indifferent_access'
require 'models/account'
class ProtectedParams < ActiveSupport::HashWithIndifferentAccess
attr_accessor :permitted
alias :permitted? :permitted
def initialize(attributes)
super(attributes)
@permitted = false
end
def permit!
@permitted = true
self
end
end
class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
test "forbidden attributes cannot be used for mass updating" do
params = ProtectedParams.new({ "a" => "b" })
assert_raises(ActiveModel::ForbiddenAttributesError) do
Account.new.sanitize_for_mass_assignment(params)
end
end
test "permitted attributes can be used for mass updating" do
params = ProtectedParams.new({ "a" => "b" }).permit!
assert_equal({ "a" => "b" }, Account.new.sanitize_for_mass_assignment(params))
end
test "regular attributes should still be allowed" do
assert_equal({ a: "b" }, Account.new.sanitize_for_mass_assignment(a: "b"))
end
end