Can't mass-assign protected attributes

Question

Updating the code formatting for better viewing.

Folks,

I have been looking at this for sometime but I don't understand what could be messing up here. I am using Devise.

class User < ActiveRecord::Base
  has_many :addresses
  accepts_nested_attributes_for :addresses

  # Other stuff here
end

class Address < ActiveRecord::Base

  belongs_to :user

  validates_presence_of :zip #:street_address1, 

end

-------------------- log output begin ------------------------------

Started POST "/users" for 127.0.0.1 at 2011-05-28 11:43:27 -0700 Processing by RegistrationsController#create as HTML Parameters: {"utf8"=>"√", "authenticity_token"=>"CEmdqlsmdYa6Jq0iIf5KAxxISsUCREIrFNXWkP80nhk=", "user"=>{"email"=>"[email protected]", "password"=>"[FILT ERED]", "addresses_attributes"=>{"0"=>{"street_address1"=>"234 Pitkin Ct.", "zip"=>"12456"}}}, "commit"=>"Sign up"} WARNING: Can't mass-assign protected attributes: addresses_attributes SQL (0.0ms) BEGIN SQL (164.0ms) SHOW TABLES
User Load (0.0ms) SELECT users.id FROM users WHERE (users.email = BINARY '[email protected]') LIMIT 1 SQL (1.0ms) ROLLBACK

-------------------- log output end ------------------------------

The zip is present in the data posted and the posted data seems to be formatted properly. On the web page form I am getting the error that "Addresses zip can't be blank". I have dug around for what causes the "Can't mass-assign protected attributes" warning but haven't found anything that will help me.

Thanks for your thoughts and pointers.

-S

Guthry

Answer 1

Have a look here and learn :)

http://railscasts.com/episodes/26-hackers-love-mass-assignment

---

Edit:

Having accepts_nested_attributes_forin User model enables you to send the data to the Address model.

Then, in the Address model, you have to set the requested attr_accessible

Tinstone

Thanks for the feedback @apneadiving. I looked through the railscasts episode and it confirms my understanding of the attr_accessible. I opened it up in my Address model (by taking out attr_accessible) so I won't have any problems. I added it back in "attr_accessible :street_address1, :zip, :address_attributes" but still get the same error. I have done this in the past and have never had to declare attr_accessible on the :nestedclass_attributes - I am wondering devise somehow does something on the backside that causes this problem. – Guthry

Tried both "attr_accessible :address_attributes" and "attr_accessible :addresses_attributes" – Guthry

in your User model: attr_accessible : addresses_attributes, in your Adress model: attr_accessible :zip, :street_address_1 – Tinstone

Indeed, Devise sets some attr_acessible in your User model, you have to keep them and add the other you need. – Tinstone

I tried adding them with "attr_accessible :street_address1, :zip, :addresses_attributes" but that doesn't help. Any thoughts on what I can do here? Thanks. – Guthry

Thanks @apneadiving. I added "attr_accessible : addresses_attributes" to the User model instead of the Address model where I was adding and that seems to work! – Guthry

@Tinstone - is the sarcasm necessary? couldn't you be gracious about providing help? and I don't think adding a smiley face makes it ok. – Departed

@Departed very pleased to hear your opinion when it comes to a problem I solved. Dont be paranoid, you waste your energy – Tinstone

Answer 2

Inside of SpecificModel (appfolder/app/model/specific_model.rb)

Try using

attr_accessible :addresses_attributes, :another_attribute_to_make_mass_assignable, :another_attribute, etc.

Irisation

Tried attr_accessible :street_address1, :zip, :address_attributes but get the same error. – Guthry

Answer 3

Nowadays (April 2013) you should start to use https://github.com/rails/strong_parameters

Selfcommand

Answer 4

Just include the datafield in the model as mentioned below

attr_accessible :addresses_attributes

Vexillum