Merge pull request rails#5049 from fabioyamate/master

Fix sanitize_for_mass_assigment when role is nil

activemodel/lib/active_model/mass_assignment_security.rb

@@ -224,12 +224,12 @@ def accessible_attributes_configs
 
   protected
 
-    def sanitize_for_mass_assignment(attributes, role = :default)
+    def sanitize_for_mass_assignment(attributes, role = nil)
       _mass_assignment_sanitizer.sanitize(attributes, mass_assignment_authorizer(role))
     end
 
-    def mass_assignment_authorizer(role = :default)
-      self.class.active_authorizer[role]
+    def mass_assignment_authorizer(role)
+      self.class.active_authorizer[role || :default]
     end
   end
 end

activemodel/test/cases/mass_assignment_security_test.rb

@@ -19,6 +19,13 @@ def test_attribute_protection
     assert_equal expected, sanitized
   end
 
+  def test_attribute_protection_when_role_is_nil
+    user = User.new
+    expected = { "name" => "John Smith", "email" => "john@smith.com" }
+    sanitized = user.sanitize_for_mass_assignment(expected.merge("admin" => true), nil)
+    assert_equal expected, sanitized
+  end
+
   def test_only_moderator_role_attribute_accessible
     user = SpecialUser.new
     expected = { "name" => "John Smith", "email" => "john@smith.com" }