A few places in the codebase check the type of argument with is_a?(Hash) when accepting input from either params (via a controller) or manually constructed hashes, e.g.

• Foreman::AccessControl.permissions_for_controller_action
• ReportImporter#initialize
• Role#allowed_to?
• User#allowed_to?

In Rails 4.2, params is an ActionController::Parameters instance, but it's a subclass of Hash. In Rails 5, it no longer inherits from Hash (https://github.com/rails/rails/commit/14a3bd5) and so checks for is_a?(Hash) return false. The checks should permit either, as both plain hashes and params are passed around in Foreman.