mass-assignment error with whitelist_attributes set to false

Question

I'm currently in the process of upgrading an application from Rails 2.3.8 to Rails 3.2.7, and am having some trouble with mass-assignment.
When I try and save any model, I get the following error:

Can't mass-assign protected attributes: a,b,c,d

I noticed that Rails had set the default for whitelisting attributes to:

config.active_record.whitelist_attributes = false

So I changed it to true, but the errors kept coming up. We use attr_protected for a few things but it seems to ignore those and protect everything. I'm guessing it is due to the model using 'accepts_nested_attributes_for', but those are necessary.

Is there any other way to solve this problem without using 'attr_accessible'?

Answer 1

Any time you use attr_accessible or attr_protected, you have enabled mass assignment protection for that model. If the website is purely for internal use as you mention in your comments, the only way to solve this without using attr_accessible, would be to remove attr_protected from the model or any models that it touches using accepts_nested_attributes_for.