Multiparameter POLA (principle of least authority) with respect to time_select fixes. See LH4346

[asanghi]

So finally i've rebased Lighthouse ticket 4346.

See discussion LH #4346 here (https://rails.lighthouseapp.com/projects/8994/tickets/4346-time_select-not-interpreting-the-multi-parameter-correctly).

/attn @fxn

/cc @dtrasbo @andreacampi

[asanghi]

Context for this ticket.

The ticket deals with errors relating to multiparamter attributes.

1. time_select allows for an option :ignore_date => true. This option was added here. It was added for design reasons where the developer wanted to style date_select and time_select differently and not have one overwrite the other.
2. :ignore_date => true usage is not documented clearly enough. Leading to bugs as reported here.
3. If you use :ignore_date => true with time_select and dont have a date_select on the same attribute, funny things will happen. Time attributes would shift to date and silently work (if the time attributes can be turned into a date) or throw up if the time attributes do not form into a valid date.
4. @asanghi with the massive input from (@andreacampi) have addressed various issues with Multiparameter attribute handling. Some of those issues include
   • Handling Date, Time distinctly from other multiparameter classes separately.
   • Handling DOS type attack by providing very high parameter indexes.
   • Handling empty parameters for Date and Time.
   • Handling nil parameters for Date and Time.
   • Raising appropriate exceptions
   • Refactoring Multiparameter attribute handling.
   • Adding many more tests.

I believe this fix should be applied to 3.0.x and possibly even to 2.3.x branch.

[fxn]

OK, good to go.

It is going to be applied to master for 3.1. The 2.3 branch is practically frozen, only security fixes and the-universe-is-going-to-collapse bug fixes. As per 3.0, while the fix could be interesting there, we think that it is safer not to introduce something like this in a minor version update. It could break existing extensions dealing with multi value attributes as https://github.com/philcrissman/multiparams_for_strings.

Thanks for keeping this ticket alive, the rebases, and for the summary above :).

[asanghi]

@fxn there are 3 warnings in test cases added to base_test.rb

`rails/activesupport/lib/active_support/core_ext/time/calculations.rb:24: warning: 2 digits year is used``

Can you suggest a way to hush them up? I was at a loss.