[FIX] web: make clean_action() allow extra properties

Some actions use 'non-standard' key in the action dict, to pass extra
parameters. In that situation the filtering of keys in `clean_action()`
strips valuable params, in an attempt to avoid leaking internal action
data.

One example of this is the dynamic action definition returned by
`open_yodlee_action()` in the account_yodlee module, which uses several
non-standard properties.

This commit alters the filtering logic in order to allow extra keys by
default, as long as they're not actual fields of the action model (and
therefore should not cause unintended "internal data" leaks).
A warning is also added to recommend passing those extra parameters in
the `context` and `params` action properties, which are explicitly
designed for this, by convention.

For cases where extra properties are returned and where the warning is
annoying, those properties can be explicitly _allowed_ by making them
virtual action fields, through a `_get_readable_fields()` override.

0 files changed, 0 insertions, 0 deletions