strong_parameters 0.1.5 → 0.1.6
Sign up to get free protection for your applications and to get access to all the features.
- data/README.rdoc +7 -1
- data/Rakefile +4 -14
- data/lib/action_controller/parameters.rb +9 -4
- data/lib/active_model/forbidden_attributes_protection.rb +2 -1
- data/lib/generators/rails/strong_parameters_controller_generator.rb +7 -0
- data/lib/strong_parameters/version.rb +1 -1
- data/test/action_controller_required_params_test.rb +7 -7
- data/test/action_controller_tainted_params_test.rb +7 -7
- data/test/active_model_mass_assignment_taint_protection_test.rb +6 -6
- data/test/gemfiles/Gemfile.rails-3.0.x +6 -0
- data/test/gemfiles/Gemfile.rails-3.0.x.lock +62 -0
- data/test/gemfiles/Gemfile.rails-3.1.x +6 -0
- data/test/gemfiles/Gemfile.rails-3.2.x +6 -0
- data/test/multi_parameter_attributes_test.rb +2 -2
- data/test/nested_parameters_test.rb +64 -39
- data/test/parameters_require_test.rb +1 -1
- data/test/parameters_taint_test.rb +34 -9
- metadata +20 -12
data/README.rdoc
CHANGED
@@ -48,6 +48,12 @@ every model you want protected.
|
|
48
48
|
include ActiveModel::ForbiddenAttributesProtection
|
49
49
|
end
|
50
50
|
|
51
|
+
If you want to now disable the default whitelisting that occurs in later versions of Rails, change the +config.active_record.whitelist_attributes+ property in your +config/application.rb+:
|
52
|
+
|
53
|
+
config.active_record.whitelist_attributes = false
|
54
|
+
|
55
|
+
This will allow you to remove / not have to use +attr_accessible+ and do mass assignment inside your code and tests.
|
56
|
+
|
51
57
|
== Compatibility
|
52
58
|
|
53
|
-
This plugin is only fully compatible with Rails versions 3.1 and 3.2 but not 4.0+, as it is part of Rails Core in 4.0.
|
59
|
+
This plugin is only fully compatible with Rails versions 3.0, 3.1 and 3.2 but not 4.0+, as it is part of Rails Core in 4.0.
|
data/Rakefile
CHANGED
@@ -1,17 +1,13 @@
|
|
1
1
|
#!/usr/bin/env rake
|
2
2
|
begin
|
3
3
|
require 'bundler/setup'
|
4
|
+
require 'bundler/gem_tasks'
|
4
5
|
rescue LoadError
|
5
|
-
|
6
|
-
end
|
7
|
-
begin
|
8
|
-
require 'rdoc/task'
|
9
|
-
rescue LoadError
|
10
|
-
require 'rdoc/rdoc'
|
11
|
-
require 'rake/rdoctask'
|
12
|
-
RDoc::Task = Rake::RDocTask
|
6
|
+
raise 'You must `gem install bundler` and `bundle install` to run rake tasks'
|
13
7
|
end
|
14
8
|
|
9
|
+
require 'rdoc/task'
|
10
|
+
|
15
11
|
RDoc::Task.new(:rdoc) do |rdoc|
|
16
12
|
rdoc.rdoc_dir = 'rdoc'
|
17
13
|
rdoc.title = 'StrongParameters'
|
@@ -20,11 +16,6 @@ RDoc::Task.new(:rdoc) do |rdoc|
|
|
20
16
|
rdoc.rdoc_files.include('lib/**/*.rb')
|
21
17
|
end
|
22
18
|
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
Bundler::GemHelper.install_tasks
|
27
|
-
|
28
19
|
require 'rake/testtask'
|
29
20
|
|
30
21
|
Rake::TestTask.new(:test) do |t|
|
@@ -34,5 +25,4 @@ Rake::TestTask.new(:test) do |t|
|
|
34
25
|
t.verbose = false
|
35
26
|
end
|
36
27
|
|
37
|
-
|
38
28
|
task :default => :test
|
@@ -44,8 +44,10 @@ module ActionController
|
|
44
44
|
case filter
|
45
45
|
when Symbol, String then
|
46
46
|
params[filter] = self[filter] if has_key?(filter)
|
47
|
-
keys.grep(/\A#{Regexp.escape(filter)}\(\d+[if]?\)\z/).each { |key| params[key] = self[key] }
|
47
|
+
keys.grep(/\A#{Regexp.escape(filter.to_s)}\(\d+[if]?\)\z/).each { |key| params[key] = self[key] }
|
48
48
|
when Hash then
|
49
|
+
filter = filter.with_indifferent_access
|
50
|
+
|
49
51
|
self.slice(*filter.keys).each do |key, value|
|
50
52
|
return unless value
|
51
53
|
|
@@ -72,16 +74,19 @@ module ActionController
|
|
72
74
|
|
73
75
|
def fetch(key, *args)
|
74
76
|
convert_hashes_to_parameters(key, super)
|
75
|
-
rescue KeyError
|
77
|
+
rescue KeyError, IndexError
|
76
78
|
raise ActionController::ParameterMissing.new(key)
|
77
79
|
end
|
78
80
|
|
79
81
|
def slice(*keys)
|
80
|
-
self.class.new(super)
|
82
|
+
self.class.new(super).tap do |new_instance|
|
83
|
+
new_instance.instance_variable_set :@permitted, @permitted
|
84
|
+
end
|
81
85
|
end
|
82
86
|
|
83
87
|
def dup
|
84
|
-
|
88
|
+
self.class.new(self).tap do |duplicate|
|
89
|
+
duplicate.default = default
|
85
90
|
duplicate.instance_variable_set :@permitted, @permitted
|
86
91
|
end
|
87
92
|
end
|
@@ -3,7 +3,8 @@ module ActiveModel
|
|
3
3
|
end
|
4
4
|
|
5
5
|
module ForbiddenAttributesProtection
|
6
|
-
def sanitize_for_mass_assignment(
|
6
|
+
def sanitize_for_mass_assignment(*options)
|
7
|
+
new_attributes = options.first
|
7
8
|
if !new_attributes.respond_to?(:permitted?) || new_attributes.permitted?
|
8
9
|
super
|
9
10
|
else
|
@@ -1,3 +1,4 @@
|
|
1
|
+
require 'rails/version'
|
1
2
|
require 'rails/generators/rails/scaffold_controller/scaffold_controller_generator'
|
2
3
|
|
3
4
|
module Rails
|
@@ -5,6 +6,12 @@ module Rails
|
|
5
6
|
class StrongParametersControllerGenerator < ScaffoldControllerGenerator
|
6
7
|
argument :attributes, :type => :array, :default => [], :banner => "field:type field:type"
|
7
8
|
source_root File.expand_path("../templates", __FILE__)
|
9
|
+
|
10
|
+
if ::Rails::VERSION::STRING < '3.1'
|
11
|
+
def module_namespacing
|
12
|
+
yield if block_given?
|
13
|
+
end
|
14
|
+
end
|
8
15
|
end
|
9
16
|
end
|
10
17
|
end
|
@@ -9,22 +9,22 @@ end
|
|
9
9
|
|
10
10
|
class ActionControllerRequiredParamsTest < ActionController::TestCase
|
11
11
|
tests BooksController
|
12
|
-
|
12
|
+
|
13
13
|
test "missing required parameters will raise exception" do
|
14
|
-
post :create, { magazine
|
14
|
+
post :create, { :magazine => { :name => "Mjallo!" } }
|
15
15
|
assert_response :bad_request
|
16
16
|
|
17
|
-
post :create, { book
|
17
|
+
post :create, { :book => { :title => "Mjallo!" } }
|
18
18
|
assert_response :bad_request
|
19
19
|
end
|
20
|
-
|
20
|
+
|
21
21
|
test "required parameters that are present will not raise" do
|
22
|
-
post :create, { book
|
22
|
+
post :create, { :book => { :name => "Mjallo!" } }
|
23
23
|
assert_response :ok
|
24
24
|
end
|
25
|
-
|
25
|
+
|
26
26
|
test "missing parameters will be mentioned in the return" do
|
27
|
-
post :create, { magazine
|
27
|
+
post :create, { :magazine => { :name => "Mjallo!" } }
|
28
28
|
assert_equal "Required parameter missing: book", response.body
|
29
29
|
end
|
30
30
|
end
|
@@ -2,24 +2,24 @@ require 'test_helper'
|
|
2
2
|
|
3
3
|
class PeopleController < ActionController::Base
|
4
4
|
def create
|
5
|
-
render text
|
5
|
+
render :text => params[:person].permitted? ? "untainted" : "tainted"
|
6
6
|
end
|
7
|
-
|
7
|
+
|
8
8
|
def create_with_permit
|
9
|
-
render text
|
9
|
+
render :text => params[:person].permit(:name).permitted? ? "untainted" : "tainted"
|
10
10
|
end
|
11
11
|
end
|
12
12
|
|
13
13
|
class ActionControllerTaintedParamsTest < ActionController::TestCase
|
14
14
|
tests PeopleController
|
15
|
-
|
15
|
+
|
16
16
|
test "parameters are tainted" do
|
17
|
-
post :create, { person
|
17
|
+
post :create, { :person => { :name => "Mjallo!" } }
|
18
18
|
assert_equal "tainted", response.body
|
19
19
|
end
|
20
|
-
|
20
|
+
|
21
21
|
test "parameters can be permitted and are then not tainted" do
|
22
|
-
post :create_with_permit, { person
|
22
|
+
post :create_with_permit, { :person => { :name => "Mjallo!" } }
|
23
23
|
assert_equal "untainted", response.body
|
24
24
|
end
|
25
25
|
end
|
@@ -3,28 +3,28 @@ require 'test_helper'
|
|
3
3
|
class Person
|
4
4
|
include ActiveModel::MassAssignmentSecurity
|
5
5
|
include ActiveModel::ForbiddenAttributesProtection
|
6
|
-
|
6
|
+
|
7
7
|
public :sanitize_for_mass_assignment
|
8
8
|
end
|
9
9
|
|
10
10
|
class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
|
11
11
|
test "forbidden attributes cannot be used for mass updating" do
|
12
12
|
assert_raises(ActiveModel::ForbiddenAttributes) do
|
13
|
-
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(a
|
13
|
+
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(:a => "b"))
|
14
14
|
end
|
15
15
|
end
|
16
16
|
|
17
17
|
test "permitted attributes can be used for mass updating" do
|
18
18
|
assert_nothing_raised do
|
19
19
|
assert_equal({ "a" => "b" },
|
20
|
-
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(a
|
20
|
+
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(:a => "b").permit(:a)))
|
21
21
|
end
|
22
22
|
end
|
23
|
-
|
23
|
+
|
24
24
|
test "regular attributes should still be allowed" do
|
25
25
|
assert_nothing_raised do
|
26
|
-
assert_equal({ a
|
27
|
-
Person.new.sanitize_for_mass_assignment(a
|
26
|
+
assert_equal({ :a => "b" },
|
27
|
+
Person.new.sanitize_for_mass_assignment(:a => "b"))
|
28
28
|
end
|
29
29
|
end
|
30
30
|
end
|
@@ -0,0 +1,62 @@
|
|
1
|
+
PATH
|
2
|
+
remote: /Users/mgrosser/code/tools/strong_parameters
|
3
|
+
specs:
|
4
|
+
strong_parameters (0.1.6.dev)
|
5
|
+
actionpack (~> 3.0)
|
6
|
+
activemodel (~> 3.0)
|
7
|
+
railties (~> 3.0)
|
8
|
+
|
9
|
+
GEM
|
10
|
+
remote: http://rubygems.org/
|
11
|
+
specs:
|
12
|
+
abstract (1.0.0)
|
13
|
+
actionpack (3.0.17)
|
14
|
+
activemodel (= 3.0.17)
|
15
|
+
activesupport (= 3.0.17)
|
16
|
+
builder (~> 2.1.2)
|
17
|
+
erubis (~> 2.6.6)
|
18
|
+
i18n (~> 0.5.0)
|
19
|
+
rack (~> 1.2.5)
|
20
|
+
rack-mount (~> 0.6.14)
|
21
|
+
rack-test (~> 0.5.7)
|
22
|
+
tzinfo (~> 0.3.23)
|
23
|
+
activemodel (3.0.17)
|
24
|
+
activesupport (= 3.0.17)
|
25
|
+
builder (~> 2.1.2)
|
26
|
+
i18n (~> 0.5.0)
|
27
|
+
activesupport (3.0.17)
|
28
|
+
builder (2.1.2)
|
29
|
+
erubis (2.6.6)
|
30
|
+
abstract (>= 1.0.0)
|
31
|
+
i18n (0.5.0)
|
32
|
+
json (1.7.5)
|
33
|
+
metaclass (0.0.1)
|
34
|
+
mocha (0.12.7)
|
35
|
+
metaclass (~> 0.0.1)
|
36
|
+
rack (1.2.5)
|
37
|
+
rack-mount (0.6.14)
|
38
|
+
rack (>= 1.0.0)
|
39
|
+
rack-test (0.5.7)
|
40
|
+
rack (>= 1.0)
|
41
|
+
railties (3.0.17)
|
42
|
+
actionpack (= 3.0.17)
|
43
|
+
activesupport (= 3.0.17)
|
44
|
+
rake (>= 0.8.7)
|
45
|
+
rdoc (~> 3.4)
|
46
|
+
thor (~> 0.14.4)
|
47
|
+
rake (10.0.1)
|
48
|
+
rdoc (3.12)
|
49
|
+
json (~> 1.4)
|
50
|
+
thor (0.14.6)
|
51
|
+
tzinfo (0.3.35)
|
52
|
+
|
53
|
+
PLATFORMS
|
54
|
+
ruby
|
55
|
+
|
56
|
+
DEPENDENCIES
|
57
|
+
actionpack (~> 3.0.0)
|
58
|
+
activemodel (~> 3.0.0)
|
59
|
+
mocha (~> 0.12.0)
|
60
|
+
railties (~> 3.0.0)
|
61
|
+
rake
|
62
|
+
strong_parameters!
|
@@ -4,7 +4,7 @@ require 'action_controller/parameters'
|
|
4
4
|
class MultiParameterAttributesTest < ActiveSupport::TestCase
|
5
5
|
test "permitted multi-parameter attribute keys" do
|
6
6
|
params = ActionController::Parameters.new({
|
7
|
-
book
|
7
|
+
:book => {
|
8
8
|
"shipped_at(1i)" => "2012",
|
9
9
|
"shipped_at(2i)" => "3",
|
10
10
|
"shipped_at(3i)" => "25",
|
@@ -18,7 +18,7 @@ class MultiParameterAttributesTest < ActiveSupport::TestCase
|
|
18
18
|
}
|
19
19
|
})
|
20
20
|
|
21
|
-
permitted = params.permit book
|
21
|
+
permitted = params.permit :book => [ :shipped_at, :price ]
|
22
22
|
|
23
23
|
assert permitted.permitted?
|
24
24
|
|
@@ -4,23 +4,23 @@ require 'action_controller/parameters'
|
|
4
4
|
class NestedParametersTest < ActiveSupport::TestCase
|
5
5
|
test "permitted nested parameters" do
|
6
6
|
params = ActionController::Parameters.new({
|
7
|
-
book
|
8
|
-
title
|
9
|
-
authors
|
10
|
-
name
|
11
|
-
born
|
7
|
+
:book => {
|
8
|
+
:title => "Romeo and Juliet",
|
9
|
+
:authors => [{
|
10
|
+
:name => "William Shakespeare",
|
11
|
+
:born => "1564-04-26"
|
12
12
|
}, {
|
13
|
-
name
|
13
|
+
:name => "Christopher Marlowe"
|
14
14
|
}],
|
15
|
-
details
|
16
|
-
pages
|
17
|
-
genre
|
15
|
+
:details => {
|
16
|
+
:pages => 200,
|
17
|
+
:genre => "Tragedy"
|
18
18
|
}
|
19
19
|
},
|
20
|
-
magazine
|
20
|
+
:magazine => "Mjallo!"
|
21
21
|
})
|
22
22
|
|
23
|
-
permitted = params.permit book
|
23
|
+
permitted = params.permit :book => [ :title, { :authors => [ :name ] }, { :details => :pages } ]
|
24
24
|
|
25
25
|
assert permitted.permitted?
|
26
26
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
@@ -32,6 +32,31 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
32
32
|
assert_nil permitted[:magazine]
|
33
33
|
end
|
34
34
|
|
35
|
+
test "permitted nested parameters with a string or a symbol as a key" do
|
36
|
+
params = ActionController::Parameters.new({
|
37
|
+
:book => {
|
38
|
+
'authors' => [
|
39
|
+
{ :name => "William Shakespeare", :born => "1564-04-26" },
|
40
|
+
{ :name => "Christopher Marlowe" }
|
41
|
+
]
|
42
|
+
}
|
43
|
+
})
|
44
|
+
|
45
|
+
permitted = params.permit :book => [ { 'authors' => [ :name ] } ]
|
46
|
+
|
47
|
+
assert_equal "William Shakespeare", permitted[:book]['authors'][0][:name]
|
48
|
+
assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
|
49
|
+
assert_equal "Christopher Marlowe", permitted[:book]['authors'][1][:name]
|
50
|
+
assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
|
51
|
+
|
52
|
+
permitted = params.permit :book => [ { :authors => [ :name ] } ]
|
53
|
+
|
54
|
+
assert_equal "William Shakespeare", permitted[:book]['authors'][0][:name]
|
55
|
+
assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
|
56
|
+
assert_equal "Christopher Marlowe", permitted[:book]['authors'][1][:name]
|
57
|
+
assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
|
58
|
+
end
|
59
|
+
|
35
60
|
test "nested arrays with strings" do
|
36
61
|
params = ActionController::Parameters.new({
|
37
62
|
:book => {
|
@@ -45,14 +70,14 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
45
70
|
|
46
71
|
test "permit may specify symbols or strings" do
|
47
72
|
params = ActionController::Parameters.new({
|
48
|
-
book
|
49
|
-
title
|
50
|
-
author
|
73
|
+
:book => {
|
74
|
+
:title => "Romeo and Juliet",
|
75
|
+
:author => "William Shakespeare"
|
51
76
|
},
|
52
|
-
magazine
|
77
|
+
:magazine => "Shakespeare Today"
|
53
78
|
})
|
54
79
|
|
55
|
-
permitted = params.permit({ book
|
80
|
+
permitted = params.permit({ :book => ["title", :author] }, "magazine")
|
56
81
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
57
82
|
assert_equal "William Shakespeare", permitted[:book][:author]
|
58
83
|
assert_equal "Shakespeare Today", permitted[:magazine]
|
@@ -60,49 +85,49 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
60
85
|
|
61
86
|
test "nested array with strings that should be hashes" do
|
62
87
|
params = ActionController::Parameters.new({
|
63
|
-
book
|
64
|
-
genres
|
88
|
+
:book => {
|
89
|
+
:genres => ["Tragedy"]
|
65
90
|
}
|
66
91
|
})
|
67
92
|
|
68
|
-
permitted = params.permit book
|
69
|
-
|
93
|
+
permitted = params.permit :book => { :genres => :type }
|
94
|
+
assert permitted[:book][:genres].empty?
|
70
95
|
end
|
71
96
|
|
72
97
|
test "nested array with strings that should be hashes and additional values" do
|
73
98
|
params = ActionController::Parameters.new({
|
74
|
-
book
|
75
|
-
title
|
76
|
-
genres
|
99
|
+
:book => {
|
100
|
+
:title => "Romeo and Juliet",
|
101
|
+
:genres => ["Tragedy"]
|
77
102
|
}
|
78
103
|
})
|
79
104
|
|
80
|
-
permitted = params.permit book
|
105
|
+
permitted = params.permit :book => [ :title, { :genres => :type } ]
|
81
106
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
82
|
-
|
107
|
+
assert permitted[:book][:genres].empty?
|
83
108
|
end
|
84
109
|
|
85
110
|
test "nested string that should be a hash" do
|
86
111
|
params = ActionController::Parameters.new({
|
87
|
-
book
|
88
|
-
genre
|
112
|
+
:book => {
|
113
|
+
:genre => "Tragedy"
|
89
114
|
}
|
90
115
|
})
|
91
116
|
|
92
|
-
permitted = params.permit book
|
117
|
+
permitted = params.permit :book => { :genre => :type }
|
93
118
|
assert_nil permitted[:book][:genre]
|
94
119
|
end
|
95
120
|
|
96
121
|
test "fields_for_style_nested_params" do
|
97
122
|
params = ActionController::Parameters.new({
|
98
|
-
book
|
99
|
-
authors_attributes
|
100
|
-
:'0' => { name
|
101
|
-
:'1' => { name
|
123
|
+
:book => {
|
124
|
+
:authors_attributes => {
|
125
|
+
:'0' => { :name => 'William Shakespeare', :age_of_death => '52' },
|
126
|
+
:'1' => { :name => 'Unattributed Assistant' }
|
102
127
|
}
|
103
128
|
}
|
104
129
|
})
|
105
|
-
permitted = params.permit book
|
130
|
+
permitted = params.permit :book => { :authors_attributes => [ :name ] }
|
106
131
|
|
107
132
|
assert_not_nil permitted[:book][:authors_attributes]['0']
|
108
133
|
assert_not_nil permitted[:book][:authors_attributes]['1']
|
@@ -112,15 +137,15 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
112
137
|
end
|
113
138
|
|
114
139
|
test "fields_for_style_nested_params with negative numbers" do
|
115
|
-
params
|
116
|
-
book
|
117
|
-
authors_attributes
|
118
|
-
:'-1' => {name
|
119
|
-
:'-2' => {name
|
140
|
+
params = ActionController::Parameters.new({
|
141
|
+
:book => {
|
142
|
+
:authors_attributes => {
|
143
|
+
:'-1' => { :name => 'William Shakespeare', :age_of_death => '52' },
|
144
|
+
:'-2' => { :name => 'Unattributed Assistant' }
|
120
145
|
}
|
121
146
|
}
|
122
147
|
})
|
123
|
-
permitted = params.permit book
|
148
|
+
permitted = params.permit :book => { :authors_attributes => [:name] }
|
124
149
|
|
125
150
|
assert_not_nil permitted[:book][:authors_attributes]['-1']
|
126
151
|
assert_not_nil permitted[:book][:authors_attributes]['-2']
|
@@ -4,7 +4,7 @@ require 'action_controller/parameters'
|
|
4
4
|
class ParametersRequireTest < ActiveSupport::TestCase
|
5
5
|
test "required parameters must be present not merely not nil" do
|
6
6
|
assert_raises(ActionController::ParameterMissing) do
|
7
|
-
ActionController::Parameters.new(person
|
7
|
+
ActionController::Parameters.new(:person => {}).require(:person)
|
8
8
|
end
|
9
9
|
end
|
10
10
|
end
|
@@ -3,8 +3,8 @@ require 'action_controller/parameters'
|
|
3
3
|
|
4
4
|
class ParametersTaintTest < ActiveSupport::TestCase
|
5
5
|
setup do
|
6
|
-
@params = ActionController::Parameters.new({ person
|
7
|
-
age
|
6
|
+
@params = ActionController::Parameters.new({ :person => {
|
7
|
+
:age => "32", :name => { :first => "David", :last => "Heinemeier Hansson" }
|
8
8
|
}})
|
9
9
|
end
|
10
10
|
|
@@ -22,34 +22,59 @@ class ParametersTaintTest < ActiveSupport::TestCase
|
|
22
22
|
end
|
23
23
|
end
|
24
24
|
|
25
|
-
test "permitted is sticky on accessors" do
|
25
|
+
test "not permitted is sticky on accessors" do
|
26
26
|
assert !@params.slice(:person).permitted?
|
27
27
|
assert !@params[:person][:name].permitted?
|
28
|
+
assert !@params[:person].except(:name).permitted?
|
28
29
|
|
29
|
-
@params.each { |key, value| assert(value.permitted?) if key ==
|
30
|
+
@params.each { |key, value| assert(!value.permitted?) if key == "person" }
|
30
31
|
|
31
32
|
assert !@params.fetch(:person).permitted?
|
32
33
|
|
33
34
|
assert !@params.values_at(:person).first.permitted?
|
34
35
|
end
|
35
36
|
|
37
|
+
test "permitted is sticky on accessors" do
|
38
|
+
@params.permit!
|
39
|
+
assert @params.slice(:person).permitted?
|
40
|
+
assert @params[:person][:name].permitted?
|
41
|
+
assert @params[:person].except(:name).permitted?
|
42
|
+
|
43
|
+
@params.each { |key, value| assert(value.permitted?) if key == "person" }
|
44
|
+
|
45
|
+
assert @params.fetch(:person).permitted?
|
46
|
+
|
47
|
+
assert @params.values_at(:person).first.permitted?
|
48
|
+
end
|
49
|
+
|
50
|
+
test "not permitted is sticky on mutators" do
|
51
|
+
assert !@params.delete_if { |k, v| k == "person" }.permitted?
|
52
|
+
assert !@params.keep_if { |k, v| k == "person" }.permitted? if @params.respond_to?(:keep_if)
|
53
|
+
end
|
54
|
+
|
36
55
|
test "permitted is sticky on mutators" do
|
37
|
-
|
38
|
-
assert
|
56
|
+
@params.permit!
|
57
|
+
assert @params.delete_if { |k, v| k == "person" }.permitted?
|
58
|
+
assert @params.keep_if { |k, v| k == "person" }.permitted? if @params.respond_to?(:keep_if)
|
59
|
+
end
|
60
|
+
|
61
|
+
test "not permitted is sticky beyond merges" do
|
62
|
+
assert !@params.merge(:a => "b").permitted?
|
39
63
|
end
|
40
64
|
|
41
65
|
test "permitted is sticky beyond merges" do
|
42
|
-
|
66
|
+
@params.permit!
|
67
|
+
assert @params.merge(:a => "b").permitted?
|
43
68
|
end
|
44
69
|
|
45
70
|
test "modifying the parameters" do
|
46
71
|
@params[:person][:hometown] = "Chicago"
|
47
|
-
@params[:person][:family] = { brother
|
72
|
+
@params[:person][:family] = { :brother => "Jonas" }
|
48
73
|
|
49
74
|
assert_equal "Chicago", @params[:person][:hometown]
|
50
75
|
assert_equal "Jonas", @params[:person][:family][:brother]
|
51
76
|
end
|
52
|
-
|
77
|
+
|
53
78
|
test "permitting parameters that are not there should not include the keys" do
|
54
79
|
assert !@params.permit(:person, :funky).has_key?(:funky)
|
55
80
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: strong_parameters
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.1.
|
4
|
+
version: 0.1.6
|
5
5
|
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2012-
|
12
|
+
date: 2012-12-15 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: actionpack
|
@@ -18,7 +18,7 @@ dependencies:
|
|
18
18
|
requirements:
|
19
19
|
- - ~>
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version: '3.
|
21
|
+
version: '3.0'
|
22
22
|
type: :runtime
|
23
23
|
prerelease: false
|
24
24
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -26,7 +26,7 @@ dependencies:
|
|
26
26
|
requirements:
|
27
27
|
- - ~>
|
28
28
|
- !ruby/object:Gem::Version
|
29
|
-
version: '3.
|
29
|
+
version: '3.0'
|
30
30
|
- !ruby/object:Gem::Dependency
|
31
31
|
name: activemodel
|
32
32
|
requirement: !ruby/object:Gem::Requirement
|
@@ -34,7 +34,7 @@ dependencies:
|
|
34
34
|
requirements:
|
35
35
|
- - ~>
|
36
36
|
- !ruby/object:Gem::Version
|
37
|
-
version: '3.
|
37
|
+
version: '3.0'
|
38
38
|
type: :runtime
|
39
39
|
prerelease: false
|
40
40
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -42,7 +42,7 @@ dependencies:
|
|
42
42
|
requirements:
|
43
43
|
- - ~>
|
44
44
|
- !ruby/object:Gem::Version
|
45
|
-
version: '3.
|
45
|
+
version: '3.0'
|
46
46
|
- !ruby/object:Gem::Dependency
|
47
47
|
name: railties
|
48
48
|
requirement: !ruby/object:Gem::Requirement
|
@@ -50,7 +50,7 @@ dependencies:
|
|
50
50
|
requirements:
|
51
51
|
- - ~>
|
52
52
|
- !ruby/object:Gem::Version
|
53
|
-
version: '3.
|
53
|
+
version: '3.0'
|
54
54
|
type: :runtime
|
55
55
|
prerelease: false
|
56
56
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -58,7 +58,7 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - ~>
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '3.
|
61
|
+
version: '3.0'
|
62
62
|
- !ruby/object:Gem::Dependency
|
63
63
|
name: rake
|
64
64
|
requirement: !ruby/object:Gem::Requirement
|
@@ -80,17 +80,17 @@ dependencies:
|
|
80
80
|
requirement: !ruby/object:Gem::Requirement
|
81
81
|
none: false
|
82
82
|
requirements:
|
83
|
-
- -
|
83
|
+
- - ~>
|
84
84
|
- !ruby/object:Gem::Version
|
85
|
-
version:
|
85
|
+
version: 0.12.0
|
86
86
|
type: :development
|
87
87
|
prerelease: false
|
88
88
|
version_requirements: !ruby/object:Gem::Requirement
|
89
89
|
none: false
|
90
90
|
requirements:
|
91
|
-
- -
|
91
|
+
- - ~>
|
92
92
|
- !ruby/object:Gem::Version
|
93
|
-
version:
|
93
|
+
version: 0.12.0
|
94
94
|
description:
|
95
95
|
email:
|
96
96
|
- david@heinemeierhansson.com
|
@@ -113,6 +113,10 @@ files:
|
|
113
113
|
- test/action_controller_tainted_params_test.rb
|
114
114
|
- test/active_model_mass_assignment_taint_protection_test.rb
|
115
115
|
- test/controller_generator_test.rb
|
116
|
+
- test/gemfiles/Gemfile.rails-3.0.x
|
117
|
+
- test/gemfiles/Gemfile.rails-3.0.x.lock
|
118
|
+
- test/gemfiles/Gemfile.rails-3.1.x
|
119
|
+
- test/gemfiles/Gemfile.rails-3.2.x
|
116
120
|
- test/multi_parameter_attributes_test.rb
|
117
121
|
- test/nested_parameters_test.rb
|
118
122
|
- test/parameters_require_test.rb
|
@@ -147,6 +151,10 @@ test_files:
|
|
147
151
|
- test/action_controller_tainted_params_test.rb
|
148
152
|
- test/active_model_mass_assignment_taint_protection_test.rb
|
149
153
|
- test/controller_generator_test.rb
|
154
|
+
- test/gemfiles/Gemfile.rails-3.0.x
|
155
|
+
- test/gemfiles/Gemfile.rails-3.0.x.lock
|
156
|
+
- test/gemfiles/Gemfile.rails-3.1.x
|
157
|
+
- test/gemfiles/Gemfile.rails-3.2.x
|
150
158
|
- test/multi_parameter_attributes_test.rb
|
151
159
|
- test/nested_parameters_test.rb
|
152
160
|
- test/parameters_require_test.rb
|