rails/strong_parameters — pull request #143 by wizcover (2013-05-20 13:47:40+00:00)
Title: Bug fix : nested ActiveSupport::HashWithIndifferentAccess were not converted to ActionController::Params

There is a bug when `params` is including nested hashes. The following should raise an `ActiveModel::ForbiddenAttributes exception` but don't:

class PeopleController < ApplicationController
def create
# params = {people: [{name: 'John Connor'},{name: 'Sarah Connor'},...]}
@people = Person.create params[:people]
...
end
end

Explanation:
1. `request.parameters` is first converted in `ActiveSupport::HashWithIndifferentAccess` and so for all nested hashes.

2. Then `ActionController::Parameters.new(request.parameters)` should convert the params hash and nested ones to `ActionController::Parameters`.

**==> The bug was that nested `ActiveSupport::HashWithIndifferentAccess` was not converted.**