Disabled fields are part of permitted params

[RST-J]

Not tested, just from looking at the code, it seems that disabled fields are not excluded from the permitted_params fields but probably should be excluded, too.

[sbilharz]

True. Right now, hidden fields are excluded but disabled fields are not. However I am not sure whether excluding both is the right solution. I had cases where I wanted to set a default value that should be permitted, but still hide the field from the user.

My conclusion was that hidden fields should always be permitted whereas disabled ones should never be. This way I can control what happens in the form class (like now, but the semantics seem better):

• If I want to hide a field from the user but still set a default value, I can hide it
• If the user shall see the field but not be able to set a value, I can disable it
• If I want to make sure the field is not visible and cannot be set, I can hide and disable it

[sbilharz]

I thought about it again and checked my real use cases. For now, there seems to be no reason to dynamically hide a field and replace it with a hidden one containing a default value, especially when regarding the idea in #11. Disabled fields should be excluded from the permitted parameters. But since the changes for #11 will be very large, if even ever applied, existing forms will continue to need the options I described in my last comment.

So the plan is now: Include hidden fields, exclude disabled fields from the permitted parameters.

@RST-J fyi