17

I have a serious problem with strong parameters. Its working pretty well in my about 200 actions but in one it doesn't because I'm working very dynamic with the parameters there and I also cant change it because of the applications design.

So I want to disable strong parameters validation in just this specific action. Is there a way to do this?

Cœur
  • 37,241
  • 25
  • 195
  • 267
davidb
  • 8,884
  • 4
  • 36
  • 72

3 Answers3

22

Strong parameters overrides the params method in ActionController::Base. You can simply override it and set it back to what you want yourself.

So this:

class MyController < ApplicationController
  def params
    request.parameters
  end
end

Will effectively disable strong parameters for all actions in your controller. You only wanted to disable it for a particular action though so you could do that with:

class MyController < ApplicationController
  before_action :use_unsafe_params, only: [:particular_action]

  def params
    @_dangerous_params || super
  end

  def particular_action
    # My params is unsafe
  end

  def normal_action
    # my params is safe
  end

  private

  def use_unsafe_params
    @_dangerous_params = request.parameters
  end
end
Ritchie
  • 1,486
  • 1
  • 15
  • 19
7

Not too sure if this is best practice but for Rails 5 I just use request.params instead of params anytime I want to skip strong params.

So instead of something like: 

post = Post.new(params[:post])

I use:

post = Post.new(request.params[:post])
Sajad Torkamani
  • 544
  • 1
  • 7
  • 18
4

You can use .permit! to whitelist any keys in a hash.

params.require(:something).permit!

However this should be treated as an extreme code smell and a security risk.

Nested hashes can be whitelisted with this trick:

params.require(:product).permit(:name, data: params[:product][:data].try(:keys))
max
  • 96,212
  • 14
  • 104
  • 165
  • This wont work for me because the name of the params isn't defined staticly they are defined by the displayed object. I know this sounds like a big security hole but I implemented security mechanisms in the method logic. I really need to turn strong parameters off in one action – davidb Jun 01 '15 at 11:02
  • The only way I can think of using `config.action_controller.permit_all_parameters` but that is done on a per-app basis. Not per action. – max Jun 01 '15 at 11:30
  • Yes for the develoment mode I disabled strong parameters but of cause I can't do this in production mode – davidb Jun 01 '15 at 11:32
  • You could create some kind of function that recursively walks the params hash and whitelists it. But I can't really give you an example since I have no idea what your controller looks like. – max Jun 01 '15 at 11:37
  • I think its easier to modify the strong parameters gem in a way that allows disabeling the gem action specific – davidb Jun 01 '15 at 11:38
  • Yeah but hacking core is almost always a bad idea. – max Jun 01 '15 at 11:39
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/79314/discussion-between-maxcal-and-davidb). – max Jun 01 '15 at 11:40