Can't mass-assign protected attributes

rubyonrails-talk
1

Hi there! I started learning Rails using the guides.rubyonrails.org/* documentation, and I have started a simple project with only two model classes so start with. However, I've came across some errors, and with some trial I got it working. I have a final question about the error "Can't mass-assign protected attributes", but first some version numbers and what I did:

% rails --version Rails 3.2.3 % rails new testapp % cd testapp % rails g scaffold project name:string file:binary % rails g scaffold auction name:string begin:datetime project:references % rake db:migrate

== CreateProjects: migrating

2

Hi there!

% rails c Loading development environment (Rails 3.2.3) irb(main):001:0> Project.all Project Load (0.1ms) SELECT "projects".* FROM "projects" => [#<Project id: 1, name: "test", file: "fff", created_at: "2012-05-05 13:05:44", updated_at: "2012-05-05 13:05:44">] irb(main):008:0> a = Auction.new(:name => "foo", :begin => nil, :project_id => 1) => #<Auction id: nil, name: "foo", begin: nil, project_id: 1, created_at: nil, updated_at: nil> irb(main):009:0> a.save() => true

% rails s

1 => trying to add an auction using the front end:http://dl.dropbox.com/u/8724298/Screen%20Shot%202012-05-05%20at%203.4… 2 => I receive another error: ActiveModel::MassAssignmentSecurity::Error in AuctionsController#create

Can't mass-assign protected attributes: project Rails.root: /private/tmp/testapp

Well you skipped over the code that raises the error, but I'm guessing you load the project from the database and do something like

Auction.new(:project => p)

If so then you need to add :project to your attr_accessible list. The prefix attr_ sort of implies that everything on the list has to be an attribute, but that's not so. Any key that you want to be allowed when calling new,create etc. should be on the list (and before you add it to the list, take a minute to think about the consequences of the user being able to set arbitrary value)

Fred