nested form "Can't mass-assign protected attributes"

Question

I have 3 models; Quote, Item, and Product.

My quote/new.html.erb is set up to render a partial which contains the item form, and in that item form a partial is rendered to choose a product.

the error: ActiveModel::MassAssignmentSecurity::Error in QuotesController#create "Can't mass-assign protected attributes: products"

(I edited out irrelevant stuff in the following) Quote.rb

class Quote < ActiveRecord::Base
   attr_accessible :items_attributes

   has_many :items, :dependent => :destroy
   accepts_nested_attributes_for :items
end

Item.rb

class Item < ActiveRecord::Base
  attr_accessible :price, :product_attributes

  belongs_to :quote
  belongs_to :product
  accepts_nested_attributes_for :product
end

Product.rb

class Product < ActiveRecord::Base
  attr_accessible :name, :item_make

  has_many :items
  accepts_nested_attributes_for :items
end

new.html.erb

<%= simple_nested_form_for @quote do |m| %>

  <%= m.simple_fields_for :items, :html => { :multipart => true } do |quoteform| %>
    <%= render "form", f: quoteform %>
  <% end %>

  <%= m.link_to_add "Add an item", :items %>
  <%= m.button :submit %>
<% end %>

_form.html.erb

<%= f.simple_fields_for :products, :html => { :multipart => true } do |x| %>
    <% render "layouts/styleselect", g: x %>
<% end %>

_styleselect.html.erb

<% g.hidden_field :item_make, :value => @item.make %>
<%= g.input :name, collection: Product.where(:item_make => 1), label: false, input_html: {:id=>"sst_style"} %>

So basically the nested form goes Quote->Item->Product, but item belongs to product, which maybe is causing the problem? I tried adding product_attributes or products_attributes to both the item model and the quote model, and the same with accepts_nested_attributes_for product(s).

Any help would be appreciated, thanks.

miler350 miler350 · Accepted Answer · 2013-10-03T03:03:58

Looks like you need to make products singular.

<%= f.simple_fields_for :product, :html => { :multipart => true } do |x| %>
    <% render "layouts/styleselect", g: x %>
<% end %>

You currently have:

<%= f.simple_fields_for :products, :html => { :multipart => true } do |x| %>

nested form "Can't mass-assign protected attributes"

1 Answers