Fixing entrypoint into actor stack that casts unpermitted attributes …

…to hash
samvera · Dec 5, 2024 · b8111f4 · b8111f4
1 parent 1062b7a
commit b8111f4
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/actors/hyrax/actors/environment.rb b/app/actors/hyrax/actors/environment.rb
@@ -8,7 +8,9 @@ class Environment
       def initialize(curation_concern, current_ability, attributes)
         @curation_concern = curation_concern
         @current_ability = current_ability
-        @attributes = attributes.to_h.with_indifferent_access
+        #@attributes = attributes.to_h.with_indifferent_access
+        # TODO how to permit a variable list of attributes safely?
+        @attributes = attributes&.permit&.to_h.with_indifferent_access
       end
 
       ##