Support for extra whitelisted params
Created by: naps62
I'm building an app based on both suspenders and administrate.
This means I have config.action_controller.action_on_unpermitted_parameters = :raise
, and I'd like to keep it that way
Another thing I have is the administrate panel under a subdomain:
constraints subdomain: "admin" do
scope module: "admin", as: "admin" do
resources :sessions, only: [:new, :create]
# ... admin dashboard routes here
end
end
This creates an unfortunate combination, where subdomain: "admin"
is automatically added to the list of params, and the app later fails because administrate's own functions sanitized_order_params
and clear_search_params
don't expect extra params to be there, causing an exception
So far, I had to override those methods on Admin::ApplicationController
:
include Admin::ApplicationHelper
helper_method :clear_search_params, :sanitized_order_params
# Overriden from administrate's original source code
# to include :subdomain param in exception list
def sanitized_order_params(page, current_field_name)
collection_names = page.item_includes + [current_field_name]
association_params = collection_names.map { |assoc_name|
{assoc_name => %i[order direction page per_page]}
}
params.except(:subdomain).permit(:search, :id, :page, :per_page, association_params)
end
# Overriden from administrate's original source code
# to include :subdomain param in exception list
def clear_search_params
params.except(:search, :page, :subdomain).permit(
:per_page, resource_name => %i[order direction]
)
end
But I'm guessing a good solution would be to add a configurable list of permitted params, and have those two functions take that into account. Or is there a better solution I might be missing?
PS: I'm willing to implement this myself, it's fairly straightforward. But I wanted feedback on the idea first