activeadmin: `:commit` and `:utf8` ignored with Strong Parameters

Oddly in Rails 4 you don’t get an exception in development if a parameter is sent by your form, but isn’t expected (the default is to log an error). However you can change that:

config.action_controller.action_on_unpermitted_parameters = :raise

So then it’s obvious when you aren’t whitelisting all of your form parameters. However once you’ve got your form working correctly, you’re still blasted with exceptions because :commit and :utf8 are being sent but aren’t expected.

The question here is: what should be done about that? Should either AA or Inhertied Resources whitelist these two params?

About this issue

Original URL
State: closed
Created 11 years ago
Comments: 15 (3 by maintainers)

Commits related to this issue

Permit utf8, authenticity_token and commit params submitted to controllers See: https://github.com/activeadmin/activeadmin/issues/2595 — committed to mtucker/outpatient by mtucker 10 years ago

Most upvoted comments

I’m getting the same error. Did this ever get fixed - utf8, authenticity_token, and commit whitelisted by active admin??

ejamesm on Apr 19, 2016

Monkey patch that is working for me, and which allow you to keep the setting :

config.action_controller.action_on_unpermitted_parameters = :raise

In your active_admin model definition :

ActiveAdmin.register Model  do
  controller do
    def permitted_params
      params.permit :utf8, :_method, :authenticity_token, :commit, :id,
                model: [:attribute1, :attribute2, ...etc. ]
    end
  end

end

deneuxa on Dec 23, 2013

@seanlinsley, what about provide 2 methods: permit_params and permit_resource_params?

ActiveAdmin.register Post do

   # This will permit all default parameters (`:utf8`, `:authenticity_token`, `:commit`, `:id`, `:_method`) and the resource attributes provided 
   permit_resource_params :title, :body

   # If user want to get full access to permitted_params, he'll use this method, telling all parameters he with to whitelist
   permit_params post: [ :title, :body ], :utf, :id

end

Rodrigora on Sep 23, 2014

I agree that these fields should be whitelisted by ActiveAdmin automatically as it generates them via the form helpers. Regardless of if you use :raise or :log you wouldn’t usually want these causing unnecessary noise.

gustavoguimaraes on May 2, 2014