config.active_record.whitelist_attributes = false in Rails 4.2 App

Our rails 4.2 app consists of several rails engines with or without gem 'protected_attributes'. What we find out is that in app's application.rb, it has to be:

config.active_record.whitelist_attributes = false

Otherwise, any create/update can not be carried out because the params can not be assigned to instance variable. Our question is that, if there is no gem protected_attributes in rails app, do we still need config.active_record.whitelist_attributes = false in application.rb? Is this for Rails 3.x or app with gem protected_attributes?