Support rails 4 protected attributes

lib/cancan/controller_resource.rb

@@ -16,6 +16,7 @@ def initialize(controller, *args)
       @params = controller.params
       @options = args.extract_options!
       @name = args.first
+      @params_method = @options.fetch(:attributes, "#{@name}_params").to_sym
       raise CanCan::ImplementationRemoved, "The :nested option is no longer supported, instead use :through with separate load/authorize call." if @options[:nested]
       raise CanCan::ImplementationRemoved, "The :name option is no longer supported, instead pass the name as the first argument." if @options[:name]
       raise CanCan::ImplementationRemoved, "The :resource option has been renamed back to :class, use false if no class." if @options[:resource]
@@ -223,7 +224,11 @@ def resource_params
     end
 
     def resource_params_by_namespaced_name
-      @params[extract_key(namespaced_name)]
+      begin
+        @controller.send(@params_method)
+      rescue
+        @params[extract_key(namespaced_name)]
+      end
     end
 
     def namespace

spec/cancan/controller_resource_spec.rb

@@ -488,4 +488,14 @@ class Section
     lambda { resource.load_and_authorize_resource }.should_not raise_error
     @controller.instance_variable_get(:@project).should be_nil
   end
+
+  context "given load_and_authorize_resource has an attributes method name" do
+    it "should use attributes method to acquire resource params" do
+      @params.merge!(:controller => "project", :action => "create")
+      sanitized = {:first => 1, :second => 2}
+      stub(@controller).attributes_method {sanitized}
+      resource = CanCan::ControllerResource.new(@controller, {:attributes => :attributes_method})
+      resource.send("resource_params_by_namespaced_name").should eq(sanitized)
+    end
+  end
 end