Fix id_param in shallow routes

[francocatena]

This fix the id_param method to return a nil when the params hash returns nil, and the string of the value otherwise. It fixed the Issue #861.

[ismaelisuani]

+1

[james2m]

+5

I forked and committed my suggested fix, but can't seem to send a pull request to you @francocatena.

[francocatena]

@james2m Thanks for the suggestion, but this actually does the same that the code I try to fix (And the code with the orginal security problem). If @params[@options[:id_params]] returns nil this method returns an empty string (the problem I try to fix) and if @params[parent? ? "#{name}_id" : 'id'] returns other than a string or nil this method does not convert it (the security issue).

[james2m]

Claro. This is still a +5 for your patch.

[jfine]

I'm seeing this issue as well with Rails 4, mongoid 4, and cancan 1.6.10. The patch above fixes this issue for me as well. @ryanb any reason to not merge this?

[JustinAiken]

:+1: for merging this

[mark-d-holmberg]

Any update on this?

[jeremyf]

:+1: to merge