plataformatec/devise — pull request #2358 by latortuga (2013-04-01 02:40:10+00:00)
Title: Rails 4 strong parameters support

This is a revision of my PR #2354 rebased against the rails4 branch.

This branch is a result of a discussion with @lucasmazza and @carlosantoniodasilva a few weeks ago about the best way to allow flexible support for `strong_parameters`. This version of the PR is based on the rails4 branch. The result is a slight deviation from the originally discussed solution but I think it represents a decent compromise - sane default configuration that is easy to override via `before_filter`.

This sets up a new class `Devise::ParameterSanitizer` to handle applying strong parameter filtering for Devise controllers in a configurable and flexible way. I added tests for the intended usage of it.

On to the code: need to use a pin field instead of a password for logging in? Simply override the session params:

```ruby
class ApplicationController
prepend_before_filter :add_allowed_devise_session_params

private

def add_allowed_devise_session_params
parameters_sanitizer.permit_devise_param(:sessions, :pin)
parameters_sanitizer.remove_permitted_devise_param(:sessions, :password)
end
end
```

Notice - no need to override any devise controllers just to configure your strong parameter filtering and the configuration can still happen at the controller level as intended by the strong parameters change.

Everything is green!