Never raise an UnpermittedParameters exception because of these params are present. They are added by Rails and it's of no concern.
This is a white list of permitted scalar types that includes the ones supported in XML and JSON requests.
This list is in particular used to filter ordinary requests, String goes as first element to quickly short-circuit the common case.
If you modify this collection please update the API of permit
above.
Action Controller Parameters
Allows to choose which attributes should be whitelisted for mass updating and thus prevent accidentally exposing that which shouldn’t be exposed. Provides two methods for this purpose: require and permit. The former is used to mark parameters as required. The latter is used to set the parameter as permitted and limit which attributes should be allowed for mass updating.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | params = ActionController::Parameters.new({ person: { name: 'Francesco', age: 22, role: 'admin' }})permitted = params.require(:person).permit(:name, :age)permitted # => {"name"=>"Francesco", "age"=>22}permitted.class # => ActionController::Parameterspermitted.permitted? # => truePerson.first.update!(permitted)# => #<Person id: 1, name: "Francesco", age: 22, role: "user"> |
It provides two options that controls the top-level behavior of new instances:
-
permit_all_parameters- If it'strue, all the parameters will be permitted by default. The default isfalse. -
action_on_unpermitted_parameters- Allow to control the behavior when parameters that are not explicitly permitted are found. The values can be:logto write a message on the logger or:raiseto raise ActionController::UnpermittedParameters exception. The default value is:login test and development environments,falseotherwise.
Examples:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | params = ActionController::Parameters.newparams.permitted? # => falseActionController::Parameters.permit_all_parameters = trueparams = ActionController::Parameters.newparams.permitted? # => trueparams = ActionController::Parameters.new(a: "123", b: "456")params.permit(:c)# => {}ActionController::Parameters.action_on_unpermitted_parameters = :raiseparams = ActionController::Parameters.new(a: "123", b: "456")params.permit(:c)# => ActionController::UnpermittedParameters: found unpermitted keys: a, b |
ActionController::Parameters is inherited from
ActiveSupport::HashWithIndifferentAccess, this means that you
can fetch values using either :key or
"key".
1 2 3 | params = ActionController::Parameters.new(key: 'value')params[:key] # => "value"params["key"] # => "value" |