Summary¶ ↑
This plugin provides two class methods on ActiveController::Base
that filter the params
hash for that controller’s actions. You can think of them as the controller analog of attr_protected
and attr_accessible
.
Installation¶ ↑
Rails 2.3.x¶ ↑
gem install param_protected -v "~> 1.0.0"
Rails 3.0.x¶ ↑
gem "param_protected", "~> 2.0.0"
Thanks to jonleighton for the Rails 3 port.
Rails 3.1.x¶ ↑
gem "param_protected", "~> 3.0.0"
Thanks to gucki for the Rails 3.1 port.
Rails 3.2.x¶ ↑
gem "param_protected", "~> 4.0.0"
Usage¶ ↑
class YourController < ActiveController::Base param_protected <param_name> <options> param_accessible <param_name> <options> ... end
param_name
can be a String, Symbol, or Array of Strings and/or Symbols.
options
is a Hash that has one of two keys: :only
or :except
. The value for these keys is a String, Symbol, or Array of Strings and/or Symbols which denotes to the action(s) for which params to protect.
Blacklisting¶ ↑
Any of these combinations should work.
param_protected :client_id param_protected [:client_id, :user_id] param_protected :client_id, :only => 'my_action' param_protected :client_id, :except => [:your_action, :my_action]
Whitelisting¶ ↑
Any of these combinations should work.
param_accessible :client_id param_accessible :[:client_id, :user_id] param_accessible :client_id, :only => 'my_action' param_accessible :client_id, :except => [:your_action, :my_action]
Nested Params¶ ↑
You can use combinations of arrays and hashes to specify nested params, much the same way ActiveRecord::Base#find
‘s :include
argument works.
param_accessible [:account_name, { :user => [:first_name, :last_name, :address => [:street, :city, :state]] }] param_protected [:id, :password, { :user => [:id, :password] }]
Merging¶ ↑
If you call param_protected
or param_accessible
multiple times for an action or actions, then the protections will be merged. For example…
param_protected [:id, :user], :only => :some_action param_protected [{ :user => [:first, :last] }, :password], :only => :some_action
Is equivalent to saying…
param_protected [:id, { :user => [:first, :last] }, :password], :only => :some_action
Credit: Moritz Heidkamp
Inheritance¶ ↑
Param protections will be inherited to derived controllers.
Credit: Moritz Heidkamp
Conditions¶ ↑
You can conditionally protect params…
param_protected :admin, :unless => "user_is_admin?" param_accessible :admin, :if => :user_is_admin? param_protected :admin, :unless => Proc.new{ |controller| controller.user_is_admin? }
Credit: Mortiz Heidkamp
Regular Expressions¶ ↑
You can use regular expressions when specifying which params to make protected or accessible.
param_accessible /item\d/
Credit: Mortiz Heidkamp
How does it work?¶ ↑
It does an alias_method_chain
on ActionController::Base#params
that filters (and caches) the params. You can get the unfiltered, pristine params by calling ActionController::Base#params_without_protection
.
Original Author¶ ↑
Christopher J. Bottaro - cjbottaro
Contributors¶ ↑
Moritz Heidkamp - DerGuteMoritz
Jon Leighton - jonleighton
Corin Langosch - gucki