protected_attributes_continued 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e01eccbad4a21cdd10334379dc742f0edc97dd8a6b99b03e8d1e105d5a159a4
-  data.tar.gz: e41d9f31ea96a9ed1edbc30063ac258f820452554d64d58f6ce0e2945027e74c
+  metadata.gz: 70d4e141e5ed0d0cb72742bcd0508f91ecf6eb8c1d245179b2304d8d7a339342
+  data.tar.gz: 89934e992683f95f7cf059c349360895041c4f8f7a9502c3e15032ef7e6e1be2
 SHA512:
-  metadata.gz: 9317411a772594accc0cbc59ca0c07a755b58f1b0c1b6553d5843cb37b6e7f3ec0defb4b5e84686a8564fafff6bb43cd803768fe230dd8b990ee236aa1281620
-  data.tar.gz: 608d732479681ce5d90a231e8f44862e54a7cb0a6ce323088c90f6dc22b52eaa85a0a7e471ee5cbe8979d6514f9f45be3fb6533a4def88dfcd2ae8a12a1ca13c
+  metadata.gz: a80e1481d125eb604db6992002f5bfb8e679c4bc69daa05b8b58f54c807c29e0b1750b782377898d748dc0304e65ae6ee479b57219c341d8702637d56d4c9b1a
+  data.tar.gz: 8f8e18e1468746c56ff4628af838666b0a367e64b52226146bec33404b5260c04a90776132797e06457fcda94ca5fb931638520e0fd26ac55e5b2badfa772b62

data/README.md

@@ -3,11 +3,9 @@
 <a href='https://travis-ci.org/westonganger/protected_attributes_continued' target='_blank'><img height='21' style='border:0px;height:21px;' src='https://api.travis-ci.org/westonganger/protected_attributes_continued.svg?branch=master' border='0' alt='Build Status' /></a>
 <a href='https://rubygems.org/gems/protected_attributes_continued' target='_blank'><img height='21' style='border:0px;height:21px;' src='https://ruby-gem-downloads-badge.herokuapp.com/protected_attributes_continued?label=rubygems&type=total&total_label=downloads&color=brightgreen' border='0' alt='RubyGems Downloads' /></a>
 
-This is the community continued version of `protected_attributes`. It works with Rails 5+ only and I recommend you only use it to support legacy portions of your application that you do not want to upgrade. Note that this feature was dropped by the Rails team and switched to strong_parameters because of security issues, just so you understand your risks. This is in use successfully in some of my Rails 5 apps in which security like this is a non-issue. For people who would like to continue using this feature in their Rails 5 apps lets continue the work here. If you are looking for a similar approach see my [recommended alternative](https://github.com/westonganger/protected_attributes_continued#a-better-alternative)
+> This is the community continued version of `protected_attributes` for Rails 5+. I recommend you only use it to support legacy portions of your application that you do not want to upgrade. The Rails team dropped this feature and switched to `strong_parameters` because of security issues. However some applications simply cannot be upgraded or security like this is a non-issue. To continue supporting this feature going forward lets continue the work here.
 
-Protect attributes from mass-assignment in Active Record models.
-
-This plugin adds the class methods `attr_accessible` and `attr_protected` to your models to be able to declare white or black lists of attributes.
+Protect attributes from mass-assignment in Active Record models. This gem adds the class methods `attr_accessible` and `attr_protected` to declare white or black lists of attributes.
 
 
 ## Installation
@@ -98,7 +96,6 @@ config.active_record.mass_assignment_sanitizer = :strict
 
 Any protected attributes violation raises `ActiveModel::MassAssignmentSecurity::Error` then.
 
-
 ## Contributing
 
 We use the `appraisal` gem for testing multiple versions of `Rails`. Please use the following steps to test using `appraisal`.
@@ -112,25 +109,24 @@ Created & Maintained by [Weston Ganger](https://westonganger.com) - [@westongang
 
 Originally forked from the dead/unmaintained `protected_attributes` gem by the Rails team.
 
-## A Better Alternative
+## A Simple and Similar strong_params Alternative
 
-While I do utilize this gem in some legacy projects I have adopted an alternative approach that is similar to this gem but only utilizes Rails built-in `strong_params` which is a much more future proof way of doing things. See the following example for how to implement.
+While I do utilize this gem in some legacy projects. The latest approach I have adopted is similar to this gem but only utilizes Rails built-in `strong_params` which is a much more future proof way of doing things. The following is an example implementation.
 
 ```ruby
+### Model
 class Post < ActiveRecord::Base
-
   def self.strong_params(params)
     params.permit(:post).permit(:name, :content, :published_at)
   end
-
 end
 
+### Controller
 class PostsController < ApplicationController
-
   def create
-    @post = Post.new
-
-    @post.assign_attributes(Post.strong_params(params))
+    @post = Post.new(Post.strong_params(params))
+    
+    @post.save
 
     respond_with @post
   end
@@ -142,6 +138,5 @@ class PostsController < ApplicationController
 
     respond_with @post
   end
-
 end
 ```

data/lib/active_record/mass_assignment_security/associations.rb

@@ -96,6 +96,25 @@ module ActiveRecord
       undef :build_record
       undef :options_for_through_record if respond_to?(:options_for_through_record, false)
 
+      if ActiveRecord.version >= Gem::Version.new('5.2.3')
+        undef :build_through_record
+
+        def build_through_record(record)
+          @through_records[record.object_id] ||= begin
+            ensure_mutable
+
+            attributes = through_scope_attributes
+            attributes[source_reflection.name] = record
+            attributes[source_reflection.foreign_type] = options[:source_type] if options[:source_type]
+
+            # Pass in `without_protection: true` here because `options_for_through_record`
+            # was removed in https://github.com/rails/rails/pull/35799
+            through_association.build(attributes, without_protection: true)
+          end
+        end
+        private :build_through_record
+      end
+
       def build_record(attributes, options = {})
         ensure_not_nested
 

data/lib/active_record/mass_assignment_security/nested_attributes.rb

@@ -54,6 +54,7 @@ module ActiveRecord
 
       def assign_nested_attributes_for_one_to_one_association(association_name, attributes, assignment_opts = {})
         options = self.nested_attributes_options[association_name]
+
         if attributes.class.name == 'ActionController::Parameters'
           attributes = attributes.to_unsafe_h
         elsif !attributes.is_a?(Hash) && !attributes.is_a?(Array)
@@ -62,8 +63,7 @@ module ActiveRecord
 
         attributes = attributes.with_indifferent_access
 
-        if  (options[:update_only] || !attributes['id'].blank?) && (record = send(association_name)) &&
-            (options[:update_only] || record.id.to_s == attributes['id'].to_s)
+        if (options[:update_only] || !attributes['id'].blank?) && (record = send(association_name)) && (options[:update_only] || record.id.to_s == attributes['id'].to_s)
           assign_to_or_mark_for_destruction(record, attributes, options[:allow_destroy], assignment_opts) unless call_reject_if(association_name, attributes)
 
         elsif attributes['id'].present? && !assignment_opts[:without_protection]
@@ -122,6 +122,12 @@ module ActiveRecord
         end
 
         attributes_collection.each do |attributes|
+          if attributes.class.name == 'ActionController::Parameters'
+            attributes = attributes.to_unsafe_h
+          elsif !attributes.is_a?(Hash) && !attributes.is_a?(Array)
+            raise ArgumentError, "ActionController::Parameters or Hash or Array expected, got #{attributes.class.name} (#{attributes.inspect})"
+          end
+          
           attributes = attributes.with_indifferent_access
 
           if attributes['id'].blank?

data/lib/protected_attributes/version.rb

@@ -1,3 +1,3 @@
 module ProtectedAttributes
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: protected_attributes_continued
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Weston Ganger
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-12-28 00:00:00.000000000 Z
+date: 2019-08-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -154,7 +154,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Protect attributes from mass assignment in Active Record models