Unpermitted params security warning

Rails
1

Hello I’m quite new to the rails 4 and I’ve not dealt with this kind of
nested security warnings, I basically have a model (receipt), with has
many
items relation. When I save a receipt, I want to have an options to save
many items as well from the same form, I ll skip the ui part and get
back
to the back end, this is how my params look like, when I print params in
the create action :

{“utf8”=>“✓”,

“authenticity_token”=>*"*0LPWkN5uG+yHrVt99f4bBN+al0FCARNhtV91NysV0TM=
",

“receipt”=>

{“store_id”=>“2”,

“purchase_date”=>“05/05/2015”,

“items_attributes”=>

{*"*1432495749993*"*=>{*"*item*"*=>{*"*name*"*=>*"*ssd*"*,

“amount”
=>“22”, “unit_id”=>“2”, “quantity”=>“1”,
“person_id”
=>“2”, “project_id”=>""}},

 *"*1432495820856*"*=>{*"*item*"*=>{*"*name*"*=>*"*ds*"*,

“amount”=>
“22”, “unit_id”=>“3”, “quantity”=>“1”,
“person_id”=>
“2”, “project_id”=>""}}}},

“action”=>“create”,

“controller”=>“receipts”}

I’ve tried following and more but none of it didn’t work :

params.require(:receipt).permit(:store_id, :purchase_date,
:items_attributes)

params.require(:receipt).permit(:store_id, :purchase_date,
items_attributes:
{‘1432495749993’ => {‘item’ => [:name]}})

params.require(:receipt).permit(:store_id, :purchase_date,
items_attributes:
{‘1432495749993’ => {‘item’ => [:name]}}).permit!

params.require(:receipt).permit(:store_id, :purchase_date,
items_attributes: {‘1432495749993’ => {‘item’ => [:id, :name, :amount,
:unit_id, :quantity, :person_id, :project_id]}})

And my nested params don’t show, this is the best result I got :

{“store_id”=>“2”, “purchase_date”=>“05/05/2015”, "
items_attributes*"=>{“1432495749993”*=>{}=>{}}}

I’m getting to the point when I don’t know what to need to ask somebody
for
help, what am I doing wrong here?

2

Nobody knows about this seriously?

3

try this:

params.require(:receipt).permit(:store_id, :purchase_date,
items_attributes: [:name, :amount, :unit_id, :quantity, :person_id,
:project_id])

Matt

4

Hi Matt,

Thanks for your response. This is the original params without
authenticity
token and controller :

“receipt”=>

{“store_id”=>“3”,

“purchase_date”=>“05/05/2015”,

“items_attributes”=>{“1432688411008”=>{“item”=>{“name”=>
“Test”, “amount”=>“2.2”, “unit_id”=>“2”,
“quantity”
=>“1”, “person_id”=>"", “project_id”=>“2”}}}}

This is what I get with what you suggested :

params.require(:receipt).permit(:store_id, :purchase_date,
items_attributes:
[:name, :amount, :unit_id, :quantity, :person_id, :project_id])

Unpermitted parameters: item

=> {“store_id”=>“3”, “purchase_date”=>“05/05/2015”, "
items_attributes*"=>{“1432688411008”*=>{}}}

Still doesn’t allow me to select items attributes.

5

you need to read
documentation:

6

Hi George,

Have added following lines to receipt model?

accepts_nested_attributes_for :items,:allow_destroy => true

Thanks
Abhishek