Unpermitted Parameters Error for Whitlisted Attributes

Question

I'm working on a sort of web based game using rails. My goal is to set up a form that allows a user to create a fort on the user/show page via a user update form. I have been using nested attributes and associations to try to solve the problem but I keep running into an error.

I have set up associations in my models such as this:

class Fort < ActiveRecord::Base

  belongs_to :user

end


class User < ActiveRecord::Base

  has_many :forts

  accepts_nested_attributes_for :forts

... (omitted validations)

end

And I have set up my Users Controller with update and edit actions like this:

def edit

    @user = User.find(params[:id])

end

def update

    @user = User.find(params[:id])

    @user.forts.build(params[:user][:forts])

    if @user.update_attributes(user_params)

    render @user


    else

        render 'users/show'

    end
end

My Form in the users/show view looks like this:

<%= form_for @user do |f| %>

  <%= f.fields_for :fort do |builder| %>
      <%= builder.label :name, "Name" %>
      <%= builder.text_field :name %>
      <%= builder.label :ownership, "Ownership" %>
      <%= builder.text_field :ownership %>
  <% end %>
    <%= f.submit %>
<% end %>

My Routes (I wouldn't think they are important here, but just in case),

BR::Application.routes.draw do
    resources :users
    resources :sessions, only: [:new, :create, :destroy]
    resources :forts
    resources :encampments

    root 'home#home'
    match '/signup',  to: 'users#new',            via: 'get'
    match '/signin',  to: 'sessions#new',            via: 'get'
    match '/signout',  to: 'sessions#destroy',            via: 'delete'

And finally my parameters are written as so:

    def user_params

        params.require(:user).permit(:name, :email, :username, :password, :password_confirmation, forts_attributes: [ :name, :xco, :yco, :territory, :ownership ])

    end

I have teetered between the above

    def user_params

        params.require(:user).permit(:name, :email, :username, :password, :password_confirmation, forts_ids: [ :name, :xco, :yco, :territory, :ownership ])

    end

and

    def user_params

        params.require(:user).permit(:name, :email, :username, :password, :password_confirmation, :forts => [ :name, :xco, :yco, :territory, :ownership ])

    end

based on different protocols I have seen on other Stack Overflow threads. None of the permutations worked.

They all threw this error in the logs:

Unpermitted parameters: fort

The entire process looks like this:

Started PATCH "/users/1" for 127.0.0.1 at 2014-09-04 20:35:02 -0400
Processing by UsersController#update as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"srybKv+WDZubO4ez+kiwfTYZvrP4tZYe9QoxQaMgmPk=", "user"=>{"fort"=>{"name"=>"test2", "ownership"=>"43"}}, "commit"=>"Update User", "id"=>"1"}
  User Load (0.2ms)  SELECT "users".* FROM "users" WHERE "users"."id" = ? LIMIT 1  [["id", "1"]]
Unpermitted parameters: fort
   (0.1ms)  begin transaction
  User Exists (0.3ms)  SELECT 1 AS one FROM "users" WHERE (LOWER("users"."email") = LOWER('[email protected]') AND "users"."id" != 1) LIMIT 1
   (0.1ms)  rollback transaction
  Rendered users/show.html.erb within layouts/application (49.2ms)
  User Load (0.4ms)  SELECT "users".* FROM "users" WHERE "users"."remember_token" = '0705e5d60cc1be62fa51d8e407683e79f730a3b2' LIMIT 1
Completed 200 OK in 173ms (Views: 66.1ms | ActiveRecord: 5.1ms)

I'm pretty sure I dotted my I's and crossed my T's but now I'm pulling my hair out trying to find my error. Any help you guys can give, would be reciprocated with my thanks forever. The only problem I can still imagine is that I am putting an update form in my users/show view, but I am almost sure that is a fine thing to do.

Thanks again,

Alex P

Answer 1

Your parameter name doesn't match what is in your user_params method: one has fort and the other has forts.

In addition, for nested attributes to work the name passed to fields_for must match the association name (ie :forts

This will result in the parameters for forts being under the forts_attributes key (and so that is what should go into user_params, but only once you've changed the call to fields_for)