CanCan and strong_parameters are friends now!
The majority of this gem is credited to @mckeed, who posted this gist: https://gist.github.com/2878508 I (@colinyoung) helped put some of it together.
Add this line to your application's Gemfile:
gem 'cancan_strong_parameters'
And then execute:
$ bundle
Or install it yourself as:
$ gem install cancan_strong_parameters
Wherever you use load_and_authorize_resource
, also add: permit_params
class PeopleController < ActionController::Base
load_and_authorize_resource :person
permit_params person: [:name, :age]
# This will raise an ActiveModel::ForbiddenAttributes exception because it's using mass assignment
# without an explicit permit step.
def create
Person.create(params[:person])
end
# This will pass with flying colors as long as there's a person key in the parameters, otherwise
# it'll raise a ActionController::MissingParameter exception, which will get caught by
# ActionController::Base and turned into that 400 Bad Request reply.
def update
redirect_to current_account.people.find(params[:id]).tap { |person|
person.update_attributes!(person_params)
}
end
private
# Using a private method to encapsulate the permissible parameters is just a good pattern
# since you'll be able to reuse the same permit list between create and update. Also, you
# can specialize this method with per-user checking of permissible attributes.
def person_params
params.require(:person).permit(:name, :age)
end
end
- Fork it
- Create your feature branch (
git checkout -b my-new-feature
) - Commit your changes (
git commit -am 'Added some feature'
) - Push to the branch (
git push origin my-new-feature
) - Create new Pull Request