rails 4 ActiveModel::ForbiddenAttributesError

Question

I try to do a simple create using rails 4

my controller:

class AdsController < ApplicationController

  def new
    @ad = Ad.new
  end

  def create
    @ad = Ad.new(params[:ad])    
    @ad.save
  end

  def show
    @ad = Ad.find(params[:id])
  end

  def index
    @ads = Ad.first(3)
  end


  private
  def ad_params    
    params.require(:ad).permit(:title, :price, :description)
  end
end

form:

<%= form_for @ad do |p| %>
  <p><%= p.text_field :title %></p>
  <p><%= p.text_field :price %></p>
  <p><%= p.text_area :description %></p>
  <p><%= p.submit %></p>
<% end %>

from my point of view it's ok but I got this error ActiveModel::ForbiddenAttributesError what I'm doing wrong?

UPDATE:

my problem was passing wrong value to new method in create action: the solution was to pass ad_params to it

score 41 · Accepted Answer · edited May 23 '17 at 11:54

41

I would suggest skipping to update so your code works

Your problem is probably not in your controller, but your model: Check to see your attributes are accessible with the follow tag

attr_accessible :title, :price, :description

Rails 4 does do it a little different from what I understand, this previous SO answer provided some good links: How is attr_accessible used in Rails 4?

You need to use attr_accessible/Strong Params whenever you're accessing things from the database.

Update

Oh to be young, and not realize Rails 4 uses Strong Params. I understand the OP has already solved his original problem, but I'm going to correct this so it could actually be used as the right answer.

This would be a controller level issue, as Rails 4 requires you to whitelist attributes in the controller.

Ad.create(params[:ad].require(:ad).permit(:title, :price, :description))

Most of the time you'll be permitting the same params in the create and update action, so it's best to move it into its own method within the controller.

Ad.create(ad_params)
def ad_params
  params.require(:ad).permit(:title, :price, :description)
end

As OP pointed out in his comment, the permitted_params method he implemented was not being called from the permit.

edited May 23 '17 at 11:54

Community

1
1

answered Jul 25 '13 at 21:02

Noah Koch

831
8
10

my problem was passing wrong value to new method in create action, solution was to pass ad_params to it – Maki Jul 25 '13 at 21:10
9

This probably shouldn't be marked as the answer. – ghempton Mar 14 '14 at 01:09
This is not the answer. – snowYetis Aug 10 '14 at 02:20
I agree, this doesn't help anything I experience the same issue and that answer didn't help anything I still get the ActiveModel::ForbiddenAttributesError in PostsController error. – Terry Aug 17 '14 at 21:57
@Ömer Posted an update a few weeks to make it not wrong, see if that works for you. – Noah Koch Aug 18 '14 at 07:39
i rewrite create active admin page controller and it helps me http://pix.toile-libre.org/upload/original/1430911651.png – stopanko May 06 '15 at 11:24
WIth the update I believe this answer is now correct. – rmcsharry Apr 07 '16 at 08:32

score 32 · Answer 2 · edited Jan 23 '14 at 13:06

32

I also faced same problem and worked for 6 hours, and finally got the solution.

Try this Code, it will help you! In Rails 4, this feature is added to deal with creation in different ways.

def new
  @ad = Ad.new
end

def create
  @ad = Ad.create(ad_params)
  @ad.save
end

private

def ad_params
  params.require(:ad).permit(:title, :price, :description)
end

edited Jan 23 '14 at 13:06

Kashif Umair Liaqat

1,064
1
18
27

answered Oct 02 '13 at 00:07

title, price, description are the column name of table Ad – Oct 02 '13 at 08:12

田咖啡 · Answer 3 · 2017-05-25T13:46:20.397

6

Ad new before add params.permit!

   def create
     params.permit!
     @ad = Ad.new(params[:ad])    
     @ad.save
   end

edited May 25 '17 at 13:46

answered Dec 02 '13 at 06:00

田咖啡

728
8
10

Please take extreme caution when using this. From the Rails documentation: "Extreme care should be taken when using permit! as it will allow all current and future model attributes to be mass-assigned." – Spyros Mandekis Sep 07 '15 at 12:32

score 1 · Answer 4 · edited Mar 02 '14 at 19:25

Your's should look like this:

def new
    @ad = Ad.new(params[:ad].permit(:title, :price, :description))
end

Mine looks like this:

def create
    @about = About.new(params[:about].permit(:introduction, :description))

    respond_to do |format|
        if @about.save
            format.html { redirect_to @about, notice: 'About was successfully created.' }
            format.json { render action: 'show', status: :created, location: @about }
        else
            format.html { render action: 'new' }
            format.json { render json: @about.errors, status: :unprocessable_entity }
        end
    end
end

rails 4 ActiveModel::ForbiddenAttributesError

4 Answers4

Linked