plataformatec/devise — pull request #1483 by cwest (2011-12-02 17:47:52+00:00)
Title: Don't pass on non-hash parameters.

A user or attacker attempts, for example:

curl -G -d 'user=a_string' http://localhost:3000/users/sign_in

Currently an exception will be thrown, because you can't call `stringify_keys` on a `String` type. Patch checks that `param[:user]` is a `Hash`, or falls back to an empty hash.