Fix sanitize_params method

README.md

@@ -238,8 +238,9 @@ When form field changes its value, form is submitted and request is made. This n
 ```ruby
 users_scope = User.active.joins(:stats)
 users_scope = users_scope.like(params[:filter]) if params[:filter]
-@users = smart_listing_create :users, users_scope, partial: "users/listing"
+@users = smart_listing_create :users, users_scope, partial: "users/listing", custom_params: [:filter]
 ```
+__smart_listing >= x.x.x__: Important notice: above that version of smart_listing remember to pass __custom_params__ option to smart_listing_create method. Then, your __custom_params__ are permitted to satisfy the strong parameters.
 
 Then, JS view is rendered and your SmartListing updated. That's it!
 

app/helpers/smart_listing/helper.rb

@@ -33,8 +33,6 @@ def _prefixes
     end
 
     class Builder
-      # Params that should not be visible in pagination links (pages, per-page, sorting, etc.)
-      UNSAFE_PARAMS = {:authenticity_token => nil, :utf8 => nil}
 
       class_attribute :smart_listing_helpers
 
@@ -48,7 +46,7 @@ def name
 
       def paginate options = {}
         if @smart_listing.collection.respond_to? :current_page
-          @template.paginate @smart_listing.collection, {:remote => @smart_listing.remote?, :param_name => @smart_listing.param_name(:page), :params => UNSAFE_PARAMS}.merge(@smart_listing.kaminari_options)
+          @template.paginate @smart_listing.collection, {:remote => @smart_listing.remote?, :param_name => @smart_listing.param_name(:page)}.merge(@smart_listing.kaminari_options)
         end
       end
 
@@ -78,7 +76,7 @@ def pagination_per_page_links options = {}
 
       def pagination_per_page_link page
         if @smart_listing.per_page.to_i != page
-          url = @template.url_for(sanitize_params(@template.params.merge(@smart_listing.all_params(:per_page => page, :page => 1))))
+          url = @template.url_for(@smart_listing.params.merge(@smart_listing.all_params(:per_page => page, :page => 1)))
         end
 
         locals = {
@@ -100,7 +98,7 @@ def sortable title, attribute, options = {}
 
         locals = {
           :order => @smart_listing.sort_order(attribute),
-          :url => @template.url_for(sanitize_params(@template.params.merge(@smart_listing.all_params(:sort => sort_params)))),
+          :url => @template.url_for(@smart_listing.params.merge(@smart_listing.all_params(:sort => sort_params))),
           :container_classes => [@template.smart_listing_config.classes(:sortable)],
           :attribute => attribute,
           :title => title
@@ -180,11 +178,6 @@ def max_count?
 
       private
 
-      def sanitize_params params
-        params = params.permit! if params.respond_to?(:permit!)
-        params.merge(UNSAFE_PARAMS)
-      end
-
       def default_locals
         {:smart_listing => @smart_listing, :builder => self}
       end

lib/smart_listing.rb

@@ -21,7 +21,9 @@ def page_param(page)
 
 module SmartListing
   class Base
-    attr_reader :name, :collection, :options, :per_page, :sort, :page, :partial, :count
+    attr_reader :name, :collection, :options, :per_page, :sort, :page, :partial, :count, :params
+    # Params that should not be visible in pagination links (pages, per-page, sorting, etc.)
+    UNSAFE_PARAMS = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze
 
     def initialize name, collection, options = {}
       @name = name
@@ -46,6 +48,9 @@ def initialize name, collection, options = {}
 
     def setup params, cookies
       @params = params
+      @params = @params.to_unsafe_h if @params.respond_to?(:to_unsafe_h)
+      @params = @params.with_indifferent_access
+      @params.except!(*UNSAFE_PARAMS)
 
       @page = get_param :page
       @per_page = !get_param(:per_page) || get_param(:per_page).empty? ? (@options[:memorize_per_page] && get_param(:per_page, cookies).to_i > 0 ? get_param(:per_page, cookies).to_i : page_sizes.first) : get_param(:per_page).to_i