Can't mass-assign protected attributes: title, description, cloth_type, pic Rails 3

Question

When doing a POST to /cloth/create I get a WARNING: Can't mass-assign protected attributes: title, description, cloth_type, pic

cloth.rb

class Cloth   
  include Mongoid::Document   
  include Mongoid::Timestamps 
  include Mongoid::MultiParameterAttributes   attr_accessible :pics

  field :title   
  field :description   
  field :cloth_type   
  belongs_to :seller   
  has_many :pics

  attr_accessible :pic_attributes   
  accepts_nested_attributes_for:pics
end

pic.rb

class Pic   
  include Mongoid::Document
  include Mongoid::Paperclip  

  has_mongoid_attached_file :image, :styles => { :medium => "300x300>", :thumb => "100x100>" },
  :storage => :cloud_files,
  :cloudfiles_credentials =>  "#{Rails.root}/config/rackspace.yml",
  :path => ":attachment/:id/:timestamp_:style.:extension"

  belongs_to :cloth
  attr_accessible :cloth_attributes

  def create        
    @cloth = Cloth.create!(params[:cloth])  
  end
end

score 6 · Accepted Answer · answered Jan 03 '13 at 15:42

The answer can be found here: http://api.rubyonrails.org/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html#method-i-attr_accessible

However, I will elucidate.

By setting attr_accessible :pic_attributes, you are setting a white list for what attributes can be set via mass assignment. In other words, you are saying that ONLY the attributes you've listed can be set by doing things like cloth = Cloth.new(params[:cloth]). Any other attribute you are saying should be set by using their accessors, such as cloth.title = params[:title].

If you need the attr_accessible, then add the other attributes to your list.

attr_accessible :pic_attributes, :title, :description, etc ...

Can't mass-assign protected attributes: title, description, cloth_type, pic Rails 3

1 Answers1