Add always permitted parameters as a configurable option.

[rafael]

• This commit adds back the always_permitted_parameters configuration option to strong parameters.
• The initial pull requests where this feature was added are the following:
  • make always permitted parameters configurable #12682
  • making always permitted params configurable strong_parameters#174

[garysweaver]

Nice! 💃

[rafaelfranca]

✂️

[rafaelfranca]

We need to update the configuring guide and also make sure if you change this configuration adding a parameter it will not raise if the parameter is present.

[rafaelfranca]

BTW, thank you for the patch.

[rafael]

@rafaelfranca no problem. Quick questions:

1. ✂️ means remove that line?
2. Could you point me to the direction in the configuration guide where this should be added?
3. Do you mean adding a test for the case when adding the configuration the exception is not raise?

Thanks!

[robin850]

Maybe we can do something like:

# config. For instance:
#
#    config.always_permitted_parameters = %w( controller action format )

Thus we will have syntax highlighting and this reads a bit better. What do you think ? :-)

[rafael]

Sure, will do that!

[rafaelfranca]

1. means remove that line?

yes.

2. Could you point me to the direction in the configuration guide where this should be added?

In the Action Pack section of https://github.com/rails/rails/blob/master/guides/source/configuring.md

3. Do you mean adding a test for the case when adding the configuration the exception is not raise?

Right now we only have test to make sure always_permitted_parameters can be set but no test to make sure it is used. If you revert the changes at https://github.com/rails/rails/pull/15933/files#diff-72f51b082f5c2a99c328f5f5bbbe8ec6R380 your tests will still pass. We should add a test where we change the values of always_permitted_parameters and when we get parameters with the values there nothing is raised.

[rafael]

@rafaelfranca: Awesome! Thanks for the feedback. I will add those changes to the PR.

[rafael]

@rafaelfranca What do you think? I added the changes and also one more test for the deprecation warning.

[rafaelfranca]

Very good ❤️. I'll add a CHANGELOG entry and merge it. Thanks.