strong_parameters 0.1.5 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README.rdoc +7 -1
- data/Rakefile +4 -14
- data/lib/action_controller/parameters.rb +9 -4
- data/lib/active_model/forbidden_attributes_protection.rb +2 -1
- data/lib/generators/rails/strong_parameters_controller_generator.rb +7 -0
- data/lib/strong_parameters/version.rb +1 -1
- data/test/action_controller_required_params_test.rb +7 -7
- data/test/action_controller_tainted_params_test.rb +7 -7
- data/test/active_model_mass_assignment_taint_protection_test.rb +6 -6
- data/test/gemfiles/Gemfile.rails-3.0.x +6 -0
- data/test/gemfiles/Gemfile.rails-3.0.x.lock +62 -0
- data/test/gemfiles/Gemfile.rails-3.1.x +6 -0
- data/test/gemfiles/Gemfile.rails-3.2.x +6 -0
- data/test/multi_parameter_attributes_test.rb +2 -2
- data/test/nested_parameters_test.rb +64 -39
- data/test/parameters_require_test.rb +1 -1
- data/test/parameters_taint_test.rb +34 -9
- metadata +20 -12
data/README.rdoc
CHANGED
@@ -48,6 +48,12 @@ every model you want protected.
|
|
48
48
|
include ActiveModel::ForbiddenAttributesProtection
|
49
49
|
end
|
50
50
|
|
51
|
+
If you want to now disable the default whitelisting that occurs in later versions of Rails, change the +config.active_record.whitelist_attributes+ property in your +config/application.rb+:
|
52
|
+
|
53
|
+
config.active_record.whitelist_attributes = false
|
54
|
+
|
55
|
+
This will allow you to remove / not have to use +attr_accessible+ and do mass assignment inside your code and tests.
|
56
|
+
|
51
57
|
== Compatibility
|
52
58
|
|
53
|
-
This plugin is only fully compatible with Rails versions 3.1 and 3.2 but not 4.0+, as it is part of Rails Core in 4.0.
|
59
|
+
This plugin is only fully compatible with Rails versions 3.0, 3.1 and 3.2 but not 4.0+, as it is part of Rails Core in 4.0.
|
data/Rakefile
CHANGED
@@ -1,17 +1,13 @@
|
|
1
1
|
#!/usr/bin/env rake
|
2
2
|
begin
|
3
3
|
require 'bundler/setup'
|
4
|
+
require 'bundler/gem_tasks'
|
4
5
|
rescue LoadError
|
5
|
-
|
6
|
-
end
|
7
|
-
begin
|
8
|
-
require 'rdoc/task'
|
9
|
-
rescue LoadError
|
10
|
-
require 'rdoc/rdoc'
|
11
|
-
require 'rake/rdoctask'
|
12
|
-
RDoc::Task = Rake::RDocTask
|
6
|
+
raise 'You must `gem install bundler` and `bundle install` to run rake tasks'
|
13
7
|
end
|
14
8
|
|
9
|
+
require 'rdoc/task'
|
10
|
+
|
15
11
|
RDoc::Task.new(:rdoc) do |rdoc|
|
16
12
|
rdoc.rdoc_dir = 'rdoc'
|
17
13
|
rdoc.title = 'StrongParameters'
|
@@ -20,11 +16,6 @@ RDoc::Task.new(:rdoc) do |rdoc|
|
|
20
16
|
rdoc.rdoc_files.include('lib/**/*.rb')
|
21
17
|
end
|
22
18
|
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
Bundler::GemHelper.install_tasks
|
27
|
-
|
28
19
|
require 'rake/testtask'
|
29
20
|
|
30
21
|
Rake::TestTask.new(:test) do |t|
|
@@ -34,5 +25,4 @@ Rake::TestTask.new(:test) do |t|
|
|
34
25
|
t.verbose = false
|
35
26
|
end
|
36
27
|
|
37
|
-
|
38
28
|
task :default => :test
|
@@ -44,8 +44,10 @@ module ActionController
|
|
44
44
|
case filter
|
45
45
|
when Symbol, String then
|
46
46
|
params[filter] = self[filter] if has_key?(filter)
|
47
|
-
keys.grep(/\A#{Regexp.escape(filter)}\(\d+[if]?\)\z/).each { |key| params[key] = self[key] }
|
47
|
+
keys.grep(/\A#{Regexp.escape(filter.to_s)}\(\d+[if]?\)\z/).each { |key| params[key] = self[key] }
|
48
48
|
when Hash then
|
49
|
+
filter = filter.with_indifferent_access
|
50
|
+
|
49
51
|
self.slice(*filter.keys).each do |key, value|
|
50
52
|
return unless value
|
51
53
|
|
@@ -72,16 +74,19 @@ module ActionController
|
|
72
74
|
|
73
75
|
def fetch(key, *args)
|
74
76
|
convert_hashes_to_parameters(key, super)
|
75
|
-
rescue KeyError
|
77
|
+
rescue KeyError, IndexError
|
76
78
|
raise ActionController::ParameterMissing.new(key)
|
77
79
|
end
|
78
80
|
|
79
81
|
def slice(*keys)
|
80
|
-
self.class.new(super)
|
82
|
+
self.class.new(super).tap do |new_instance|
|
83
|
+
new_instance.instance_variable_set :@permitted, @permitted
|
84
|
+
end
|
81
85
|
end
|
82
86
|
|
83
87
|
def dup
|
84
|
-
|
88
|
+
self.class.new(self).tap do |duplicate|
|
89
|
+
duplicate.default = default
|
85
90
|
duplicate.instance_variable_set :@permitted, @permitted
|
86
91
|
end
|
87
92
|
end
|
@@ -3,7 +3,8 @@ module ActiveModel
|
|
3
3
|
end
|
4
4
|
|
5
5
|
module ForbiddenAttributesProtection
|
6
|
-
def sanitize_for_mass_assignment(
|
6
|
+
def sanitize_for_mass_assignment(*options)
|
7
|
+
new_attributes = options.first
|
7
8
|
if !new_attributes.respond_to?(:permitted?) || new_attributes.permitted?
|
8
9
|
super
|
9
10
|
else
|
@@ -1,3 +1,4 @@
|
|
1
|
+
require 'rails/version'
|
1
2
|
require 'rails/generators/rails/scaffold_controller/scaffold_controller_generator'
|
2
3
|
|
3
4
|
module Rails
|
@@ -5,6 +6,12 @@ module Rails
|
|
5
6
|
class StrongParametersControllerGenerator < ScaffoldControllerGenerator
|
6
7
|
argument :attributes, :type => :array, :default => [], :banner => "field:type field:type"
|
7
8
|
source_root File.expand_path("../templates", __FILE__)
|
9
|
+
|
10
|
+
if ::Rails::VERSION::STRING < '3.1'
|
11
|
+
def module_namespacing
|
12
|
+
yield if block_given?
|
13
|
+
end
|
14
|
+
end
|
8
15
|
end
|
9
16
|
end
|
10
17
|
end
|
@@ -9,22 +9,22 @@ end
|
|
9
9
|
|
10
10
|
class ActionControllerRequiredParamsTest < ActionController::TestCase
|
11
11
|
tests BooksController
|
12
|
-
|
12
|
+
|
13
13
|
test "missing required parameters will raise exception" do
|
14
|
-
post :create, { magazine
|
14
|
+
post :create, { :magazine => { :name => "Mjallo!" } }
|
15
15
|
assert_response :bad_request
|
16
16
|
|
17
|
-
post :create, { book
|
17
|
+
post :create, { :book => { :title => "Mjallo!" } }
|
18
18
|
assert_response :bad_request
|
19
19
|
end
|
20
|
-
|
20
|
+
|
21
21
|
test "required parameters that are present will not raise" do
|
22
|
-
post :create, { book
|
22
|
+
post :create, { :book => { :name => "Mjallo!" } }
|
23
23
|
assert_response :ok
|
24
24
|
end
|
25
|
-
|
25
|
+
|
26
26
|
test "missing parameters will be mentioned in the return" do
|
27
|
-
post :create, { magazine
|
27
|
+
post :create, { :magazine => { :name => "Mjallo!" } }
|
28
28
|
assert_equal "Required parameter missing: book", response.body
|
29
29
|
end
|
30
30
|
end
|
@@ -2,24 +2,24 @@ require 'test_helper'
|
|
2
2
|
|
3
3
|
class PeopleController < ActionController::Base
|
4
4
|
def create
|
5
|
-
render text
|
5
|
+
render :text => params[:person].permitted? ? "untainted" : "tainted"
|
6
6
|
end
|
7
|
-
|
7
|
+
|
8
8
|
def create_with_permit
|
9
|
-
render text
|
9
|
+
render :text => params[:person].permit(:name).permitted? ? "untainted" : "tainted"
|
10
10
|
end
|
11
11
|
end
|
12
12
|
|
13
13
|
class ActionControllerTaintedParamsTest < ActionController::TestCase
|
14
14
|
tests PeopleController
|
15
|
-
|
15
|
+
|
16
16
|
test "parameters are tainted" do
|
17
|
-
post :create, { person
|
17
|
+
post :create, { :person => { :name => "Mjallo!" } }
|
18
18
|
assert_equal "tainted", response.body
|
19
19
|
end
|
20
|
-
|
20
|
+
|
21
21
|
test "parameters can be permitted and are then not tainted" do
|
22
|
-
post :create_with_permit, { person
|
22
|
+
post :create_with_permit, { :person => { :name => "Mjallo!" } }
|
23
23
|
assert_equal "untainted", response.body
|
24
24
|
end
|
25
25
|
end
|
@@ -3,28 +3,28 @@ require 'test_helper'
|
|
3
3
|
class Person
|
4
4
|
include ActiveModel::MassAssignmentSecurity
|
5
5
|
include ActiveModel::ForbiddenAttributesProtection
|
6
|
-
|
6
|
+
|
7
7
|
public :sanitize_for_mass_assignment
|
8
8
|
end
|
9
9
|
|
10
10
|
class ActiveModelMassUpdateProtectionTest < ActiveSupport::TestCase
|
11
11
|
test "forbidden attributes cannot be used for mass updating" do
|
12
12
|
assert_raises(ActiveModel::ForbiddenAttributes) do
|
13
|
-
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(a
|
13
|
+
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(:a => "b"))
|
14
14
|
end
|
15
15
|
end
|
16
16
|
|
17
17
|
test "permitted attributes can be used for mass updating" do
|
18
18
|
assert_nothing_raised do
|
19
19
|
assert_equal({ "a" => "b" },
|
20
|
-
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(a
|
20
|
+
Person.new.sanitize_for_mass_assignment(ActionController::Parameters.new(:a => "b").permit(:a)))
|
21
21
|
end
|
22
22
|
end
|
23
|
-
|
23
|
+
|
24
24
|
test "regular attributes should still be allowed" do
|
25
25
|
assert_nothing_raised do
|
26
|
-
assert_equal({ a
|
27
|
-
Person.new.sanitize_for_mass_assignment(a
|
26
|
+
assert_equal({ :a => "b" },
|
27
|
+
Person.new.sanitize_for_mass_assignment(:a => "b"))
|
28
28
|
end
|
29
29
|
end
|
30
30
|
end
|
@@ -0,0 +1,62 @@
|
|
1
|
+
PATH
|
2
|
+
remote: /Users/mgrosser/code/tools/strong_parameters
|
3
|
+
specs:
|
4
|
+
strong_parameters (0.1.6.dev)
|
5
|
+
actionpack (~> 3.0)
|
6
|
+
activemodel (~> 3.0)
|
7
|
+
railties (~> 3.0)
|
8
|
+
|
9
|
+
GEM
|
10
|
+
remote: http://rubygems.org/
|
11
|
+
specs:
|
12
|
+
abstract (1.0.0)
|
13
|
+
actionpack (3.0.17)
|
14
|
+
activemodel (= 3.0.17)
|
15
|
+
activesupport (= 3.0.17)
|
16
|
+
builder (~> 2.1.2)
|
17
|
+
erubis (~> 2.6.6)
|
18
|
+
i18n (~> 0.5.0)
|
19
|
+
rack (~> 1.2.5)
|
20
|
+
rack-mount (~> 0.6.14)
|
21
|
+
rack-test (~> 0.5.7)
|
22
|
+
tzinfo (~> 0.3.23)
|
23
|
+
activemodel (3.0.17)
|
24
|
+
activesupport (= 3.0.17)
|
25
|
+
builder (~> 2.1.2)
|
26
|
+
i18n (~> 0.5.0)
|
27
|
+
activesupport (3.0.17)
|
28
|
+
builder (2.1.2)
|
29
|
+
erubis (2.6.6)
|
30
|
+
abstract (>= 1.0.0)
|
31
|
+
i18n (0.5.0)
|
32
|
+
json (1.7.5)
|
33
|
+
metaclass (0.0.1)
|
34
|
+
mocha (0.12.7)
|
35
|
+
metaclass (~> 0.0.1)
|
36
|
+
rack (1.2.5)
|
37
|
+
rack-mount (0.6.14)
|
38
|
+
rack (>= 1.0.0)
|
39
|
+
rack-test (0.5.7)
|
40
|
+
rack (>= 1.0)
|
41
|
+
railties (3.0.17)
|
42
|
+
actionpack (= 3.0.17)
|
43
|
+
activesupport (= 3.0.17)
|
44
|
+
rake (>= 0.8.7)
|
45
|
+
rdoc (~> 3.4)
|
46
|
+
thor (~> 0.14.4)
|
47
|
+
rake (10.0.1)
|
48
|
+
rdoc (3.12)
|
49
|
+
json (~> 1.4)
|
50
|
+
thor (0.14.6)
|
51
|
+
tzinfo (0.3.35)
|
52
|
+
|
53
|
+
PLATFORMS
|
54
|
+
ruby
|
55
|
+
|
56
|
+
DEPENDENCIES
|
57
|
+
actionpack (~> 3.0.0)
|
58
|
+
activemodel (~> 3.0.0)
|
59
|
+
mocha (~> 0.12.0)
|
60
|
+
railties (~> 3.0.0)
|
61
|
+
rake
|
62
|
+
strong_parameters!
|
@@ -4,7 +4,7 @@ require 'action_controller/parameters'
|
|
4
4
|
class MultiParameterAttributesTest < ActiveSupport::TestCase
|
5
5
|
test "permitted multi-parameter attribute keys" do
|
6
6
|
params = ActionController::Parameters.new({
|
7
|
-
book
|
7
|
+
:book => {
|
8
8
|
"shipped_at(1i)" => "2012",
|
9
9
|
"shipped_at(2i)" => "3",
|
10
10
|
"shipped_at(3i)" => "25",
|
@@ -18,7 +18,7 @@ class MultiParameterAttributesTest < ActiveSupport::TestCase
|
|
18
18
|
}
|
19
19
|
})
|
20
20
|
|
21
|
-
permitted = params.permit book
|
21
|
+
permitted = params.permit :book => [ :shipped_at, :price ]
|
22
22
|
|
23
23
|
assert permitted.permitted?
|
24
24
|
|
@@ -4,23 +4,23 @@ require 'action_controller/parameters'
|
|
4
4
|
class NestedParametersTest < ActiveSupport::TestCase
|
5
5
|
test "permitted nested parameters" do
|
6
6
|
params = ActionController::Parameters.new({
|
7
|
-
book
|
8
|
-
title
|
9
|
-
authors
|
10
|
-
name
|
11
|
-
born
|
7
|
+
:book => {
|
8
|
+
:title => "Romeo and Juliet",
|
9
|
+
:authors => [{
|
10
|
+
:name => "William Shakespeare",
|
11
|
+
:born => "1564-04-26"
|
12
12
|
}, {
|
13
|
-
name
|
13
|
+
:name => "Christopher Marlowe"
|
14
14
|
}],
|
15
|
-
details
|
16
|
-
pages
|
17
|
-
genre
|
15
|
+
:details => {
|
16
|
+
:pages => 200,
|
17
|
+
:genre => "Tragedy"
|
18
18
|
}
|
19
19
|
},
|
20
|
-
magazine
|
20
|
+
:magazine => "Mjallo!"
|
21
21
|
})
|
22
22
|
|
23
|
-
permitted = params.permit book
|
23
|
+
permitted = params.permit :book => [ :title, { :authors => [ :name ] }, { :details => :pages } ]
|
24
24
|
|
25
25
|
assert permitted.permitted?
|
26
26
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
@@ -32,6 +32,31 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
32
32
|
assert_nil permitted[:magazine]
|
33
33
|
end
|
34
34
|
|
35
|
+
test "permitted nested parameters with a string or a symbol as a key" do
|
36
|
+
params = ActionController::Parameters.new({
|
37
|
+
:book => {
|
38
|
+
'authors' => [
|
39
|
+
{ :name => "William Shakespeare", :born => "1564-04-26" },
|
40
|
+
{ :name => "Christopher Marlowe" }
|
41
|
+
]
|
42
|
+
}
|
43
|
+
})
|
44
|
+
|
45
|
+
permitted = params.permit :book => [ { 'authors' => [ :name ] } ]
|
46
|
+
|
47
|
+
assert_equal "William Shakespeare", permitted[:book]['authors'][0][:name]
|
48
|
+
assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
|
49
|
+
assert_equal "Christopher Marlowe", permitted[:book]['authors'][1][:name]
|
50
|
+
assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
|
51
|
+
|
52
|
+
permitted = params.permit :book => [ { :authors => [ :name ] } ]
|
53
|
+
|
54
|
+
assert_equal "William Shakespeare", permitted[:book]['authors'][0][:name]
|
55
|
+
assert_equal "William Shakespeare", permitted[:book][:authors][0][:name]
|
56
|
+
assert_equal "Christopher Marlowe", permitted[:book]['authors'][1][:name]
|
57
|
+
assert_equal "Christopher Marlowe", permitted[:book][:authors][1][:name]
|
58
|
+
end
|
59
|
+
|
35
60
|
test "nested arrays with strings" do
|
36
61
|
params = ActionController::Parameters.new({
|
37
62
|
:book => {
|
@@ -45,14 +70,14 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
45
70
|
|
46
71
|
test "permit may specify symbols or strings" do
|
47
72
|
params = ActionController::Parameters.new({
|
48
|
-
book
|
49
|
-
title
|
50
|
-
author
|
73
|
+
:book => {
|
74
|
+
:title => "Romeo and Juliet",
|
75
|
+
:author => "William Shakespeare"
|
51
76
|
},
|
52
|
-
magazine
|
77
|
+
:magazine => "Shakespeare Today"
|
53
78
|
})
|
54
79
|
|
55
|
-
permitted = params.permit({ book
|
80
|
+
permitted = params.permit({ :book => ["title", :author] }, "magazine")
|
56
81
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
57
82
|
assert_equal "William Shakespeare", permitted[:book][:author]
|
58
83
|
assert_equal "Shakespeare Today", permitted[:magazine]
|
@@ -60,49 +85,49 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
60
85
|
|
61
86
|
test "nested array with strings that should be hashes" do
|
62
87
|
params = ActionController::Parameters.new({
|
63
|
-
book
|
64
|
-
genres
|
88
|
+
:book => {
|
89
|
+
:genres => ["Tragedy"]
|
65
90
|
}
|
66
91
|
})
|
67
92
|
|
68
|
-
permitted = params.permit book
|
69
|
-
|
93
|
+
permitted = params.permit :book => { :genres => :type }
|
94
|
+
assert permitted[:book][:genres].empty?
|
70
95
|
end
|
71
96
|
|
72
97
|
test "nested array with strings that should be hashes and additional values" do
|
73
98
|
params = ActionController::Parameters.new({
|
74
|
-
book
|
75
|
-
title
|
76
|
-
genres
|
99
|
+
:book => {
|
100
|
+
:title => "Romeo and Juliet",
|
101
|
+
:genres => ["Tragedy"]
|
77
102
|
}
|
78
103
|
})
|
79
104
|
|
80
|
-
permitted = params.permit book
|
105
|
+
permitted = params.permit :book => [ :title, { :genres => :type } ]
|
81
106
|
assert_equal "Romeo and Juliet", permitted[:book][:title]
|
82
|
-
|
107
|
+
assert permitted[:book][:genres].empty?
|
83
108
|
end
|
84
109
|
|
85
110
|
test "nested string that should be a hash" do
|
86
111
|
params = ActionController::Parameters.new({
|
87
|
-
book
|
88
|
-
genre
|
112
|
+
:book => {
|
113
|
+
:genre => "Tragedy"
|
89
114
|
}
|
90
115
|
})
|
91
116
|
|
92
|
-
permitted = params.permit book
|
117
|
+
permitted = params.permit :book => { :genre => :type }
|
93
118
|
assert_nil permitted[:book][:genre]
|
94
119
|
end
|
95
120
|
|
96
121
|
test "fields_for_style_nested_params" do
|
97
122
|
params = ActionController::Parameters.new({
|
98
|
-
book
|
99
|
-
authors_attributes
|
100
|
-
:'0' => { name
|
101
|
-
:'1' => { name
|
123
|
+
:book => {
|
124
|
+
:authors_attributes => {
|
125
|
+
:'0' => { :name => 'William Shakespeare', :age_of_death => '52' },
|
126
|
+
:'1' => { :name => 'Unattributed Assistant' }
|
102
127
|
}
|
103
128
|
}
|
104
129
|
})
|
105
|
-
permitted = params.permit book
|
130
|
+
permitted = params.permit :book => { :authors_attributes => [ :name ] }
|
106
131
|
|
107
132
|
assert_not_nil permitted[:book][:authors_attributes]['0']
|
108
133
|
assert_not_nil permitted[:book][:authors_attributes]['1']
|
@@ -112,15 +137,15 @@ class NestedParametersTest < ActiveSupport::TestCase
|
|
112
137
|
end
|
113
138
|
|
114
139
|
test "fields_for_style_nested_params with negative numbers" do
|
115
|
-
params
|
116
|
-
book
|
117
|
-
authors_attributes
|
118
|
-
:'-1' => {name
|
119
|
-
:'-2' => {name
|
140
|
+
params = ActionController::Parameters.new({
|
141
|
+
:book => {
|
142
|
+
:authors_attributes => {
|
143
|
+
:'-1' => { :name => 'William Shakespeare', :age_of_death => '52' },
|
144
|
+
:'-2' => { :name => 'Unattributed Assistant' }
|
120
145
|
}
|
121
146
|
}
|
122
147
|
})
|
123
|
-
permitted = params.permit book
|
148
|
+
permitted = params.permit :book => { :authors_attributes => [:name] }
|
124
149
|
|
125
150
|
assert_not_nil permitted[:book][:authors_attributes]['-1']
|
126
151
|
assert_not_nil permitted[:book][:authors_attributes]['-2']
|
@@ -4,7 +4,7 @@ require 'action_controller/parameters'
|
|
4
4
|
class ParametersRequireTest < ActiveSupport::TestCase
|
5
5
|
test "required parameters must be present not merely not nil" do
|
6
6
|
assert_raises(ActionController::ParameterMissing) do
|
7
|
-
ActionController::Parameters.new(person
|
7
|
+
ActionController::Parameters.new(:person => {}).require(:person)
|
8
8
|
end
|
9
9
|
end
|
10
10
|
end
|
@@ -3,8 +3,8 @@ require 'action_controller/parameters'
|
|
3
3
|
|
4
4
|
class ParametersTaintTest < ActiveSupport::TestCase
|
5
5
|
setup do
|
6
|
-
@params = ActionController::Parameters.new({ person
|
7
|
-
age
|
6
|
+
@params = ActionController::Parameters.new({ :person => {
|
7
|
+
:age => "32", :name => { :first => "David", :last => "Heinemeier Hansson" }
|
8
8
|
}})
|
9
9
|
end
|
10
10
|
|
@@ -22,34 +22,59 @@ class ParametersTaintTest < ActiveSupport::TestCase
|
|
22
22
|
end
|
23
23
|
end
|
24
24
|
|
25
|
-
test "permitted is sticky on accessors" do
|
25
|
+
test "not permitted is sticky on accessors" do
|
26
26
|
assert !@params.slice(:person).permitted?
|
27
27
|
assert !@params[:person][:name].permitted?
|
28
|
+
assert !@params[:person].except(:name).permitted?
|
28
29
|
|
29
|
-
@params.each { |key, value| assert(value.permitted?) if key ==
|
30
|
+
@params.each { |key, value| assert(!value.permitted?) if key == "person" }
|
30
31
|
|
31
32
|
assert !@params.fetch(:person).permitted?
|
32
33
|
|
33
34
|
assert !@params.values_at(:person).first.permitted?
|
34
35
|
end
|
35
36
|
|
37
|
+
test "permitted is sticky on accessors" do
|
38
|
+
@params.permit!
|
39
|
+
assert @params.slice(:person).permitted?
|
40
|
+
assert @params[:person][:name].permitted?
|
41
|
+
assert @params[:person].except(:name).permitted?
|
42
|
+
|
43
|
+
@params.each { |key, value| assert(value.permitted?) if key == "person" }
|
44
|
+
|
45
|
+
assert @params.fetch(:person).permitted?
|
46
|
+
|
47
|
+
assert @params.values_at(:person).first.permitted?
|
48
|
+
end
|
49
|
+
|
50
|
+
test "not permitted is sticky on mutators" do
|
51
|
+
assert !@params.delete_if { |k, v| k == "person" }.permitted?
|
52
|
+
assert !@params.keep_if { |k, v| k == "person" }.permitted? if @params.respond_to?(:keep_if)
|
53
|
+
end
|
54
|
+
|
36
55
|
test "permitted is sticky on mutators" do
|
37
|
-
|
38
|
-
assert
|
56
|
+
@params.permit!
|
57
|
+
assert @params.delete_if { |k, v| k == "person" }.permitted?
|
58
|
+
assert @params.keep_if { |k, v| k == "person" }.permitted? if @params.respond_to?(:keep_if)
|
59
|
+
end
|
60
|
+
|
61
|
+
test "not permitted is sticky beyond merges" do
|
62
|
+
assert !@params.merge(:a => "b").permitted?
|
39
63
|
end
|
40
64
|
|
41
65
|
test "permitted is sticky beyond merges" do
|
42
|
-
|
66
|
+
@params.permit!
|
67
|
+
assert @params.merge(:a => "b").permitted?
|
43
68
|
end
|
44
69
|
|
45
70
|
test "modifying the parameters" do
|
46
71
|
@params[:person][:hometown] = "Chicago"
|
47
|
-
@params[:person][:family] = { brother
|
72
|
+
@params[:person][:family] = { :brother => "Jonas" }
|
48
73
|
|
49
74
|
assert_equal "Chicago", @params[:person][:hometown]
|
50
75
|
assert_equal "Jonas", @params[:person][:family][:brother]
|
51
76
|
end
|
52
|
-
|
77
|
+
|
53
78
|
test "permitting parameters that are not there should not include the keys" do
|
54
79
|
assert !@params.permit(:person, :funky).has_key?(:funky)
|
55
80
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: strong_parameters
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.1.
|
4
|
+
version: 0.1.6
|
5
5
|
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2012-
|
12
|
+
date: 2012-12-15 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: actionpack
|
@@ -18,7 +18,7 @@ dependencies:
|
|
18
18
|
requirements:
|
19
19
|
- - ~>
|
20
20
|
- !ruby/object:Gem::Version
|
21
|
-
version: '3.
|
21
|
+
version: '3.0'
|
22
22
|
type: :runtime
|
23
23
|
prerelease: false
|
24
24
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -26,7 +26,7 @@ dependencies:
|
|
26
26
|
requirements:
|
27
27
|
- - ~>
|
28
28
|
- !ruby/object:Gem::Version
|
29
|
-
version: '3.
|
29
|
+
version: '3.0'
|
30
30
|
- !ruby/object:Gem::Dependency
|
31
31
|
name: activemodel
|
32
32
|
requirement: !ruby/object:Gem::Requirement
|
@@ -34,7 +34,7 @@ dependencies:
|
|
34
34
|
requirements:
|
35
35
|
- - ~>
|
36
36
|
- !ruby/object:Gem::Version
|
37
|
-
version: '3.
|
37
|
+
version: '3.0'
|
38
38
|
type: :runtime
|
39
39
|
prerelease: false
|
40
40
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -42,7 +42,7 @@ dependencies:
|
|
42
42
|
requirements:
|
43
43
|
- - ~>
|
44
44
|
- !ruby/object:Gem::Version
|
45
|
-
version: '3.
|
45
|
+
version: '3.0'
|
46
46
|
- !ruby/object:Gem::Dependency
|
47
47
|
name: railties
|
48
48
|
requirement: !ruby/object:Gem::Requirement
|
@@ -50,7 +50,7 @@ dependencies:
|
|
50
50
|
requirements:
|
51
51
|
- - ~>
|
52
52
|
- !ruby/object:Gem::Version
|
53
|
-
version: '3.
|
53
|
+
version: '3.0'
|
54
54
|
type: :runtime
|
55
55
|
prerelease: false
|
56
56
|
version_requirements: !ruby/object:Gem::Requirement
|
@@ -58,7 +58,7 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - ~>
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '3.
|
61
|
+
version: '3.0'
|
62
62
|
- !ruby/object:Gem::Dependency
|
63
63
|
name: rake
|
64
64
|
requirement: !ruby/object:Gem::Requirement
|
@@ -80,17 +80,17 @@ dependencies:
|
|
80
80
|
requirement: !ruby/object:Gem::Requirement
|
81
81
|
none: false
|
82
82
|
requirements:
|
83
|
-
- -
|
83
|
+
- - ~>
|
84
84
|
- !ruby/object:Gem::Version
|
85
|
-
version:
|
85
|
+
version: 0.12.0
|
86
86
|
type: :development
|
87
87
|
prerelease: false
|
88
88
|
version_requirements: !ruby/object:Gem::Requirement
|
89
89
|
none: false
|
90
90
|
requirements:
|
91
|
-
- -
|
91
|
+
- - ~>
|
92
92
|
- !ruby/object:Gem::Version
|
93
|
-
version:
|
93
|
+
version: 0.12.0
|
94
94
|
description:
|
95
95
|
email:
|
96
96
|
- david@heinemeierhansson.com
|
@@ -113,6 +113,10 @@ files:
|
|
113
113
|
- test/action_controller_tainted_params_test.rb
|
114
114
|
- test/active_model_mass_assignment_taint_protection_test.rb
|
115
115
|
- test/controller_generator_test.rb
|
116
|
+
- test/gemfiles/Gemfile.rails-3.0.x
|
117
|
+
- test/gemfiles/Gemfile.rails-3.0.x.lock
|
118
|
+
- test/gemfiles/Gemfile.rails-3.1.x
|
119
|
+
- test/gemfiles/Gemfile.rails-3.2.x
|
116
120
|
- test/multi_parameter_attributes_test.rb
|
117
121
|
- test/nested_parameters_test.rb
|
118
122
|
- test/parameters_require_test.rb
|
@@ -147,6 +151,10 @@ test_files:
|
|
147
151
|
- test/action_controller_tainted_params_test.rb
|
148
152
|
- test/active_model_mass_assignment_taint_protection_test.rb
|
149
153
|
- test/controller_generator_test.rb
|
154
|
+
- test/gemfiles/Gemfile.rails-3.0.x
|
155
|
+
- test/gemfiles/Gemfile.rails-3.0.x.lock
|
156
|
+
- test/gemfiles/Gemfile.rails-3.1.x
|
157
|
+
- test/gemfiles/Gemfile.rails-3.2.x
|
150
158
|
- test/multi_parameter_attributes_test.rb
|
151
159
|
- test/nested_parameters_test.rb
|
152
160
|
- test/parameters_require_test.rb
|