rails/protected_attributes — pull request #24 by fullbridge-batkins (2013-09-30 22:51:18+00:00)
Title: Remove default enabling of whitelist attributes

The behavior of the gem currently differs from how Protected Attributes acted in Rails `3.x` in that whitelist attributes gets turned on by default if the app's config has an `active_record` hash/block defined. In Rails `3.x`, if you left the `whitelist_attributes` line commented out on your config file, it would not be enabled by default, wheras the gem now seems to be enabling it by default. I've modified the code to remove the enabling of whitelist attributes by default.

Without this pull request, the user has to manually go in and declare:
```ruby
config.active_record.whitelist_attributes = false
```
on their `application.rb` if they want to disable whitelist attributes. The mention of the whitelist attributes feature in the [`Usage` section of the README](https://github.com/rails/protected_attributes#usage) makes it seem as though the behavior should be working like this, unless I'm misreading it.