sorcery + rails 4 + attr_protected + little bug as bonus

[the-teacher]

Hello!

I create new Rails 4 beta Application with Sorcery.

1) Rails said to me:

RuntimeError in WelcomeController#index

attr_protected is extracted out of Rails into a gem. Please use new recommended protection model for params(strong_parameters) or add protected_attributes to your Gemfile to use old one.

gem 'protected_attributes' solve this problem.

Will It be changed in future? I just want to know.

2)

For Rails 4 I add require 'sorcery/engine' at top of config/initializers/sorcery.rb

require 'sorcery/engine'

# Available submodules are: :user_activation, :http_basic_auth, :remember_me,
# :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
# :reset_password
Rails.application.config.sorcery.submodules = [:remember_me]

Maybe it can be helpful for somebody.

Thanks!

[Ian-Choi]

Thanks, I hit the same problem (1) too. I hope this will be fixed soon.

[rogercampos]

I think sorcery should not include attr_protected by default. It's up to the app how to protected their attributes in mass-assignment, and this behaviour will be changed in Rails 4 as well.

[Ian-Choi]

At the time being, based on my team's experiment, add this to the application configuration will by pass the attr protected on Rails 4. I believe this is the configuration for Rails 3 to use strong params.

config.active_record.whitelist_attributes = false

[ankane]

I agree with @rogercampos. Rails 4 is removes attr_protected in favor of strong_parameters, so this line should be removed.

https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb#L82

[Fustrate]

Any news on this?

[burlesona]

+1 on this suggestion. I think if this is documented this can just be moved into any sorcery-using models in Rails 3.x, and it should be left out as of Rails 4.

[burlesona]

+1 On @aew 's pull request, I've tested and it works for Rails 4 apps.

One other note, right now Protected Attributes breaks Rails 4 deployment on Heroku (rails/protected_attributes#13), so removing this requirement from Sorcery would be pretty valuable.

[Emerson]

Would love to hear some news about this. - Edit: Ah, never mind - totally missed the part where the fix was merged in.

[batasrki]

@Emerson, actually the latest release of Sorcery is 2 months ago and the build is failing, so even if the fix is in, you can't rely on the master branch in the Gemfile.

Any news when the Rails 4 compatibility will be released?

[hoetmaaiers]

+1

[batasrki]

I withdraw my comment, as @NoamB merged in my PR that fixes the build. Use the master branch to get things working for Rails 4.

Thanks, @NoamB for thé quick merge, :)

[eprothro]

Any plan to get this released in a new version soon?

[kirs]

@eprothro we will make a new release in October, but you can use it from master for now.