Carrierwave Can't mass-assign protected attributes: path when uploading using jquery-fileupload-rails

Question

I'm trying to get a simple file upload working using

• jquery-fileupload-rails
• carrierwave
• fog

I cannot find the cause of the following error

Started POST "/pictures" for 127.0.0.1 at 2012-07-27 15:19:37 +0100
Processing by PicturesController#create as JSON
  Parameters: {"utf8"=>"✓",
  authenticity_token"=>"NKek0e/kfVRUk4SVBjokO5rL446dKvHo9+7mKuH0HKs=", "picture"=>   
  {"path"=>#  <ActionDispatch::Http::UploadedFile:0x00000002d48fa8 
  @original_filename="IMG_0001.JPG", @content_type="image/jpeg", @headers="Content-
  Disposition: form-data; name=\"picture[path]\"; filename=\"IMG_0001.JPG\"\r\nContent-
  Type: image/jpeg\r\n", @tempfile=#<File:/tmp/RackMultipart20120727-7807-1bcbfof>>}}
Completed 500 Internal Server Error in 1ms

ActiveModel::MassAssignmentSecurity::Error (Can't mass-assign protected attributes: 
path):
  app/controllers/pictures_controller.rb:9:in `new'
  app/controllers/pictures_controller.rb:9:in `create'

The model, controller and view are taken from

https://github.com/blueimp/jQuery-File-Upload/wiki/Rails-setup-for-V6

The error message leads me to think that I need to make 'path' accessible, but how? Note that the jquery-file-upload bit is working (I have got the bootstrap buttons, the pictures appear on screen, etc, only the file upload itself obviously does not work!)

For completeness, this is picture.rb:

class Picture < ActiveRecord::Base

  include Rails.application.routes.url_helpers
  attr_accessible :avatar
  mount_uploader :avatar, AvatarUploader

  def to_jq_upload
    {
      "name" => read_attribute(:avatar),
      "size" => avatar.size,
      "url" => avatar.url,
      "thumbnail_url" => avatar.thumb.url,
      "delete_url" => picture_path(:id => id),
      "delete_type" => "DELETE" 
    }
  end
end

The corresponding controller is

class PicturesController < ApplicationController  

  def index
    @pictures = Picture.all
    render :json => @pictures.collect { |p| p.to_jq_upload }.to_json
  end

  def create
    @picture = Picture.new(params[:picture])
    @picture.save!
    if @picture.save
      respond_to do |format|
        format.html {  
          render :json => [@picture.to_jq_upload].to_json, 
          :content_type => 'text/html',
          :layout => false
        }
        format.json {  
          render :json => [@picture.to_jq_upload].to_json     
        }
      end
    else 
      render :json => [{:error => "custom_failure"}], :status => 304
    end
  end

  def destroy
    @picture = Picture.find(params[:id])
    @picture.destroy
    render :json => true
  end

end

This is the uploader class:

class AvatarUploader < CarrierWave::Uploader::Base

  storage :file

  def store_dir
    "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
  end


end

Answer 1

I figured out the solution myself: The error was in the view where instead of :path it should read :avatar, and :avatar needs to be accessible. An example implementation where the options for jQuery File Upload are also set can be found at https://github.com/apotry/jquery_fileupload_carrierwave_fog