Merge pull request #8132 from bquorning/permitted_is_sticky_on_slice

Permitted should be sticky on #slice

actionpack/lib/action_controller/metal/strong_parameters.rb

@@ -259,7 +259,9 @@ def fetch(key, *args)
     #   params.slice(:a, :b) # => {"a"=>1, "b"=>2}
     #   params.slice(:d)     # => {}
     def slice(*keys)
-      self.class.new(super)
+      self.class.new(super).tap do |new_instance|
+        new_instance.instance_variable_set :@permitted, @permitted
+      end
     end
 
     # Returns an exact copy of the <tt>ActionController::Parameters</tt>

actionpack/test/controller/parameters/parameters_permit_test.rb

@@ -20,26 +20,51 @@ class ParametersPermitTest < ActiveSupport::TestCase
     assert_equal "monkey", @params.fetch(:foo) { "monkey" }
   end
 
-  test "permitted is sticky on accessors" do
+  test "not permitted is sticky on accessors" do
     assert !@params.slice(:person).permitted?
     assert !@params[:person][:name].permitted?
+    assert !@params[:person].except(:name).permitted?
 
-    @params.each { |key, value| assert(value.permitted?) if key == :person }
+    @params.each { |key, value| assert(!value.permitted?) if key == "person" }
 
     assert !@params.fetch(:person).permitted?
 
     assert !@params.values_at(:person).first.permitted?
   end
 
+  test "permitted is sticky on accessors" do
+    @params.permit!
+    assert @params.slice(:person).permitted?
+    assert @params[:person][:name].permitted?
+    assert @params[:person].except(:name).permitted?
+
+    @params.each { |key, value| assert(value.permitted?) if key == "person" }
+
+    assert @params.fetch(:person).permitted?
+
+    assert @params.values_at(:person).first.permitted?
+  end
+
+  test "not permitted is sticky on mutators" do
+    assert !@params.delete_if { |k| k == "person" }.permitted?
+    assert !@params.keep_if { |k,v| k == "person" }.permitted?
+  end
+
   test "permitted is sticky on mutators" do
-    assert !@params.delete_if { |k| k == :person }.permitted?
-    assert !@params.keep_if { |k,v| k == :person }.permitted?
+    @params.permit!
+    assert @params.delete_if { |k| k == "person" }.permitted?
+    assert @params.keep_if { |k,v| k == "person" }.permitted?
   end
 
-  test "permitted is sticky beyond merges" do
+  test "not permitted is sticky beyond merges" do
     assert !@params.merge(a: "b").permitted?
   end
 
+  test "permitted is sticky beyond merges" do
+    @params.permit!
+    assert @params.merge(a: "b").permitted?
+  end
+
   test "modifying the parameters" do
     @params[:person][:hometown] = "Chicago"
     @params[:person][:family] = { brother: "Jonas" }
@@ -77,7 +102,7 @@ class ParametersPermitTest < ActiveSupport::TestCase
       ActionController::Parameters.permit_all_parameters = false
     end
   end
-  
+
   test "permitting parameters as an array" do
     assert_equal "32", @params[:person].permit([ :age ])[:age]
   end