Add support for Strong Params

[liveh2o]

Active Record now enforces attribute whitelisting through Strong Params, but ARem doesn't support it. It should.

[liveh2o]

Not actually an issue. Active Record has nothing to do with Strong Params.

[brianstien]

This is still a problem, here is an example

class User < ::ActiveRecord::Base
end

UsersController < ::ApplicationController::Base
  def update
    @user = User.find(params[:id])
    @user.update_attributes(params[:user]) # raises ActiveModel::ForbiddenAttributes because params have not been sanitized with strong params
  end
end

class User < ::ActiveRemote::Base
end

UsersController < ::ApplicationController::Base
  def update
    @user = User.find(params[:id])
    @user.update_attributes(params[:user]) # does not raise an error, allows mass assignment vulnerability
  end
end

[brianstien]

I think we need to include ActiveModel::ForbiddenAttributesProtection into ActiveRemote::Base

https://github.com/cgriego/active_attr#massassignment

[liveh2o]

Tricky. I'll get something up soon.

[liveh2o]

Closing this because the work on v3.0 (#36) covers it.