Handle strong params in spree/admin/products_controller

openfoodfoundation · Feb 23, 2020 · 83deb8a · 83deb8a
1 parent 6a86798
commit 83deb8a
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/app/controllers/spree/admin/products_controller.rb b/app/controllers/spree/admin/products_controller.rb
@@ -160,10 +160,16 @@ def collection_actions
       private
 
       def product_set_from_params(params)
-        collection_hash = Hash[params[:products].each_with_index.map { |p, i| [i, p] }]
+        collection_hash = Hash[products_params.each_with_index.map { |p, i| [i, p] }]
         Spree::ProductSet.new(collection_attributes: collection_hash)
       end
 
+      def products_params
+        params.require(:products).map do |product|
+          ActionController::Parameters.new(product.to_hash).permit(:id, :name)
+        end
+      end
+
       def bulk_index_query(params)
         params[:filters].to_h.merge(page: params[:page], per_page: params[:per_page])
       end