From 6e84ea540179d0f3f1f65dd57067021ae36640d0 Mon Sep 17 00:00:00 2001
From: Georgios Kalpakas <kalpakas.g@gmail.com>
Date: Mon, 4 Jul 2016 22:36:37 +0300
Subject: [PATCH 1/2] fix($resource): append extra params even if
 `Object.prototype` has properties with the same name

Fixes #14866
---
 src/ngResource/resource.js      |  2 +-
 test/ngResource/resourceSpec.js | 43 +++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/src/ngResource/resource.js b/src/ngResource/resource.js
index 31a594421e50..d3e4132423b0 100644
--- a/src/ngResource/resource.js
+++ b/src/ngResource/resource.js
@@ -591,7 +591,7 @@ angular.module('ngResource', ['ng']).
 
           // set params - delegate param encoding to $http
           forEach(params, function(value, key) {
-            if (!self.urlParams[key]) {
+            if (!self.urlParams.hasOwnProperty(key)) {
               config.params = config.params || {};
               config.params[key] = value;
             }
diff --git a/test/ngResource/resourceSpec.js b/test/ngResource/resourceSpec.js
index a848f06d1244..4f30d5c3052f 100644
--- a/test/ngResource/resourceSpec.js
+++ b/test/ngResource/resourceSpec.js
@@ -1363,6 +1363,49 @@ describe("basic usage", function() {
   });
 });
 
+describe('extra params', function() {
+  var $http;
+  var $httpBackend;
+  var $resource;
+
+  beforeEach(module('ngResource'));
+
+  beforeEach(module(function($provide) {
+    $provide.decorator('$http', function($delegate) {
+      return jasmine.createSpy('$http').and.callFake($delegate);
+    });
+  }));
+
+  beforeEach(inject(function(_$http_, _$httpBackend_, _$resource_) {
+    $http = _$http_;
+    $httpBackend = _$httpBackend_;
+    $resource = _$resource_;
+  }));
+
+  afterEach(function() {
+    $httpBackend.verifyNoOutstandingExpectation();
+  });
+
+
+  it('should pass extra params to `$http` as `config.params`', function() {
+    $httpBackend.expectGET('/bar?baz=qux').respond('{}');
+
+    var R = $resource('/:foo');
+    R.get({foo: 'bar', baz: 'qux'});
+
+    expect($http).toHaveBeenCalledWith(jasmine.objectContaining({params: {baz: 'qux'}}));
+  });
+
+  it('should pass extra params even if `Object.prototype` has properties with the same name',
+    function() {
+      $httpBackend.expectGET('/foo?toString=bar').respond('{}');
+
+      var R = $resource('/foo');
+      R.get({toString: 'bar'});
+    }
+  );
+});
+
 describe('errors', function() {
   var $httpBackend, $resource, $q;
 

From 2aa28ff019cbe54b954ddbeb0533f0c940c37144 Mon Sep 17 00:00:00 2001
From: Georgios Kalpakas <kalpakas.g@gmail.com>
Date: Tue, 5 Jul 2016 09:52:44 +0300
Subject: [PATCH 2/2] fixup 1

- Use `Object.create(null)` to avoid `hasOwnProperty()` check.
---
 src/ngResource/resource.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/ngResource/resource.js b/src/ngResource/resource.js
index d3e4132423b0..da2cffcd0bb3 100644
--- a/src/ngResource/resource.js
+++ b/src/ngResource/resource.js
@@ -535,7 +535,7 @@ angular.module('ngResource', ['ng']).
             encodedVal,
             protocolAndDomain = '';
 
-          var urlParams = self.urlParams = {};
+          var urlParams = self.urlParams = Object.create(null);
           forEach(url.split(/\W/), function(param) {
             if (param === 'hasOwnProperty') {
               throw $resourceMinErr('badname', "hasOwnProperty is not a valid parameter name.");
@@ -591,7 +591,7 @@ angular.module('ngResource', ['ng']).
 
           // set params - delegate param encoding to $http
           forEach(params, function(value, key) {
-            if (!self.urlParams.hasOwnProperty(key)) {
+            if (!self.urlParams[key]) {
               config.params = config.params || {};
               config.params[key] = value;
             }