attr-encrypted/attr_encrypted — pull request #89 by 97jaz (2014-02-01 21:52:59+00:00)
Title: Stops attr_encrypted from breaking strong parameters

attr_encrypted's current behavior is to call `symbolize_keys`
on the attributes that it's given. It then passes the resulting
hash to the underlying ActiveRecord `assign_attributes` method.
This, however, entirely defeats the security of strong parameters
in Rails 4 (and Rails 3 with the strong_parameters gem). Calling
`symbolize_keys` on an instance of ActionController::Parameters
returns a plain Hash, which does not respond to `permitted?`.

This patch will instead call `with_indifferent_access` on the
passed-in attributes, if that method is available. (If not, it
falls back to `symbolize_keys`.) `with_indifferent_access` has
been in ActiveSupport since Rails 3.0, and the strong parameters
gem will not work with an earlier version of Rails, so this
should work wherever strong parameters do.