@@ -19,13 +19,13 @@ def initialize(param) # :nodoc:
19
19
end
20
20
end
21
21
22
- # == Action Controller Parameters
22
+ # == Action Controller \ Parameters
23
23
#
24
24
# Allows to choose which attributes should be whitelisted for mass updating
25
25
# and thus prevent accidentally exposing that which shouldn’t be exposed.
26
26
# Provides two methods for this purpose: #require and #permit. The former is
27
27
# used to mark parameters as required. The latter is used to set the parameter
28
- # as permitted and limit which attributes should be allowed for mass updating.
28
+ # as permitted and limit which attributes should be allowed for mass updating.
29
29
#
30
30
# params = ActionController::Parameters.new({
31
31
# person: {
@@ -77,12 +77,12 @@ class Parameters < ActiveSupport::HashWithIndifferentAccess
77
77
#
78
78
# params = ActionController::Parameters.new(name: 'Francesco')
79
79
# params.permitted? # => false
80
- # Person.new(params) # => ActiveModel::ForbiddenAttributesError
80
+ # Person.new(params) # => ActiveModel::ForbiddenAttributesError
81
81
#
82
82
# ActionController::Parameters.permit_all_parameters = true
83
83
#
84
84
# params = ActionController::Parameters.new(name: 'Francesco')
85
- # params.permitted? # => true
85
+ # params.permitted? # => true
86
86
# Person.new(params) # => #<Person id: nil, name: "Francesco">
87
87
def initialize ( attributes = nil )
88
88
super ( attributes )
@@ -106,7 +106,7 @@ def permitted?
106
106
# end
107
107
#
108
108
# params = ActionController::Parameters.new(name: 'Francesco')
109
- # params.permitted? # => false
109
+ # params.permitted? # => false
110
110
# Person.new(params) # => ActiveModel::ForbiddenAttributesError
111
111
# params.permit!
112
112
# params.permitted? # => true
@@ -125,7 +125,7 @@ def permit!
125
125
# the parameter at the given +key+, otherwise raises an
126
126
# <tt>ActionController::ParameterMissing</tt> error.
127
127
#
128
- # ActionController::Parameters.new(person: { name: 'Francesco' }).require(:person)
128
+ # ActionController::Parameters.new(person: { name: 'Francesco' }).require(:person)
129
129
# # => {"name"=>"Francesco"}
130
130
#
131
131
# ActionController::Parameters.new(person: nil).require(:person)
@@ -141,21 +141,21 @@ def require(key)
141
141
alias :required :require
142
142
143
143
# Returns a new <tt>ActionController::Parameters</tt> instance that
144
- # includes only the given +filters+ and sets the +permitted+ for the
145
- # object to +true+. This is useful for limiting which attributes
144
+ # includes only the given +filters+ and sets the +permitted+ attribute
145
+ # for the object to +true+. This is useful for limiting which attributes
146
146
# should be allowed for mass updating.
147
147
#
148
148
# params = ActionController::Parameters.new(user: { name: 'Francesco', age: 22, role: 'admin' })
149
149
# permitted = params.require(:user).permit(:name, :age)
150
- # permitted.permitted? # => true
150
+ # permitted.permitted? # => true
151
151
# permitted.has_key?(:name) # => true
152
152
# permitted.has_key?(:age) # => true
153
153
# permitted.has_key?(:role) # => false
154
154
#
155
155
# You can also use +permit+ on nested parameters, like:
156
156
#
157
157
# params = ActionController::Parameters.new({
158
- # person: {
158
+ # person: {
159
159
# name: 'Francesco',
160
160
# age: 22,
161
161
# pets: [{
@@ -168,7 +168,7 @@ def require(key)
168
168
# permitted = params.permit(person: [ :name, { pets: :name } ])
169
169
# permitted.permitted? # => true
170
170
# permitted[:person][:name] # => "Francesco"
171
- # permitted[:person][:age] # => nil
171
+ # permitted[:person][:age] # => nil
172
172
# permitted[:person][:pets][0][:name] # => "Purplish"
173
173
# permitted[:person][:pets][0][:category] # => nil
174
174
#
@@ -229,7 +229,7 @@ def permit(*filters)
229
229
# returns +nil+.
230
230
#
231
231
# params = ActionController::Parameters.new(person: { name: 'Francesco' })
232
- # params[:person] # => {"name"=>"Francesco"}
232
+ # params[:person] # => {"name"=>"Francesco"}
233
233
# params[:none] # => nil
234
234
def []( key )
235
235
convert_hashes_to_parameters ( key , super )
@@ -242,10 +242,10 @@ def [](key)
242
242
# is given, then that will be run and its result returned.
243
243
#
244
244
# params = ActionController::Parameters.new(person: { name: 'Francesco' })
245
- # params.fetch(:person) # => {"name"=>"Francesco"}
246
- # params.fetch(:none) # => ActionController::ParameterMissing: param not found: none
245
+ # params.fetch(:person) # => {"name"=>"Francesco"}
246
+ # params.fetch(:none) # => ActionController::ParameterMissing: param not found: none
247
247
# params.fetch(:none, 'Francesco') # => "Francesco"
248
- # params.fetch(:none) { 'Francesco' } # => "Francesco"
248
+ # params.fetch(:none) { 'Francesco' } # => "Francesco"
249
249
def fetch ( key , *args )
250
250
convert_hashes_to_parameters ( key , super )
251
251
rescue KeyError
@@ -303,7 +303,7 @@ def each_element(object)
303
303
# == Strong \Parameters
304
304
#
305
305
# It provides an interface for protecting attributes from end-user
306
- # assignment. This makes Action Controller parameters forbidden
306
+ # assignment. This makes Action Controller parameters forbidden
307
307
# to be used in Active Model mass assignment until they have been
308
308
# whitelisted.
309
309
#
@@ -332,14 +332,39 @@ def each_element(object)
332
332
#
333
333
# private
334
334
# # Using a private method to encapsulate the permissible parameters is
335
- # # just a good pattern since you'll be able to reuse the same permit
335
+ # # just a good pattern since you'll be able to reuse the same permit
336
336
# # list between create and update. Also, you can specialize this method
337
337
# # with per-user checking of permissible attributes.
338
338
# def person_params
339
339
# params.require(:person).permit(:name, :age)
340
340
# end
341
341
# end
342
342
#
343
+ # In order to use <tt>accepts_nested_attribute_for</tt> with Strong \Parameters, you
344
+ # will need to specify which nested attributes should be whitelisted.
345
+ #
346
+ # class Person
347
+ # has_many :pets
348
+ # accepts_nested_attributes_for :pets
349
+ # end
350
+ #
351
+ # class PeopleController < ActionController::Base
352
+ # def create
353
+ # Person.create(person_params)
354
+ # end
355
+ #
356
+ # ...
357
+ #
358
+ # private
359
+ #
360
+ # def person_params
361
+ # # It's mandatory to specify the nested attributes that should be whitelisted.
362
+ # # If you use `permit` with just the key that points to the nested attributes hash,
363
+ # # it will return an empty hash.
364
+ # params.require(:person).permit(:name, :age, pets_attributes: { :name, :category })
365
+ # end
366
+ # end
367
+ #
343
368
# See ActionController::Parameters.require and ActionController::Parameters.permit
344
369
# for more information.
345
370
module StrongParameters
0 commit comments