{"action":"created","issue":{"url":"https://api.github.com/repos/codebrew/backbone-rails/issues/188","repository_url":"https://api.github.com/repos/codebrew/backbone-rails","labels_url":"https://api.github.com/repos/codebrew/backbone-rails/issues/188/labels{/name}","comments_url":"https://api.github.com/repos/codebrew/backbone-rails/issues/188/comments","events_url":"https://api.github.com/repos/codebrew/backbone-rails/issues/188/events","html_url":"https://github.com/codebrew/backbone-rails/issues/188","id":59291428,"number":188,"title":"Overriding Backbone.sync breaks Rails' strong parameters","user":{"login":"jarrett","id":16208,"avatar_url":"https://avatars.githubusercontent.com/u/16208?v=3","gravatar_id":"","url":"https://api.github.com/users/jarrett","html_url":"https://github.com/jarrett","followers_url":"https://api.github.com/users/jarrett/followers","following_url":"https://api.github.com/users/jarrett/following{/other_user}","gists_url":"https://api.github.com/users/jarrett/gists{/gist_id}","starred_url":"https://api.github.com/users/jarrett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jarrett/subscriptions","organizations_url":"https://api.github.com/users/jarrett/orgs","repos_url":"https://api.github.com/users/jarrett/repos","events_url":"https://api.github.com/users/jarrett/events{/privacy}","received_events_url":"https://api.github.com/users/jarrett/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2015-02-27T20:41:58Z","updated_at":"2016-07-05T17:38:15Z","closed_at":null,"body":"[Line 19 in backbone_rails_sync.js](https://github.com/codebrew/backbone-rails/blob/master/vendor/assets/javascripts/backbone_rails_sync.js#L19) reads:\r\n\r\n    data = JSON.stringify(options.attrs || model.toJSON(options));\r\n\r\nIt looks like this variable is always overwritten in the next few lines:\r\n\r\n    if (model.paramRoot) {\r\n      data = {};\r\n      data[model.paramRoot] = model.toJSON(options);\r\n    } else {\r\n      data = model.toJSON();\r\n    }\r\n\r\nSo line 19 seems to do nothing. If I'm correct, It's a few CPU cycles gone to waste.\r\n\r\nMore importantly though, `options.attrs` is ignored. That's bad because it breaks calls like the following:\r\n\r\n    myModelInstance.save({name: \"example\"}, {patch: true});\r\n\r\nThe above should send only `{name: \"example\"}` rather than the whole attributes hash in the HTTP request. This is very important in Rails, where [strong parameters](http://edgeguides.rubyonrails.org/action_controller_overview.html#strong-parameters) is the officially supported way to whitelist attributes. In Rails, you want to be able to set `config.action_controller.action_on_unpermitted_parameters = :raise` to catch your own mistakes, but it breaks when backbone-rails forces you to send every attribute with every request."},"comment":{"url":"https://api.github.com/repos/codebrew/backbone-rails/issues/comments/230548121","html_url":"https://github.com/codebrew/backbone-rails/issues/188#issuecomment-230548121","issue_url":"https://api.github.com/repos/codebrew/backbone-rails/issues/188","id":230548121,"user":{"login":"reidcooper","id":6921277,"avatar_url":"https://avatars.githubusercontent.com/u/6921277?v=3","gravatar_id":"","url":"https://api.github.com/users/reidcooper","html_url":"https://github.com/reidcooper","followers_url":"https://api.github.com/users/reidcooper/followers","following_url":"https://api.github.com/users/reidcooper/following{/other_user}","gists_url":"https://api.github.com/users/reidcooper/gists{/gist_id}","starred_url":"https://api.github.com/users/reidcooper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reidcooper/subscriptions","organizations_url":"https://api.github.com/users/reidcooper/orgs","repos_url":"https://api.github.com/users/reidcooper/repos","events_url":"https://api.github.com/users/reidcooper/events{/privacy}","received_events_url":"https://api.github.com/users/reidcooper/received_events","type":"User","site_admin":false},"created_at":"2016-07-05T17:38:15Z","updated_at":"2016-07-05T17:38:15Z","body":"+1 to bump"}}
{"actor":{"display_login":"reidcooper"}}