Unpermitted parameter using fields_for Rails

Question

I got such message in console when trying to use fields_for in Rails:

Parameters: .... "task"=>{"task_name"=>"111", "tag"=>{"tag_text"=>"222"}}, "commit"=>"Save"}
Unpermitted parameter: tag

My models with has_many and belongs_to:

class Task < ActiveRecord::Base
  has_many    :tags
  accepts_nested_attributes_for :tags
end

class Tag < ActiveRecord::Base
  belongs_to :task
end

Form helper for new/edit page:

<%= form_for(@task) do |f| %>
    <%= f.text_field :task_name %>
        <%= f.fields_for([@task, @task.tags.build]) do |t| %>
        <%= t.text_field :tag_text %>
        <% end %>
    <%= f.submit 'Save' %>
<% end %>

My Task Controller (I used scaffold to generate it, and its mostly default)

class TasksController < ApplicationController
  before_action :set_task, only: [:show, :edit, :update, :destroy]


  def index
    @tasks = Task.all
  end

  def show
  end

  def new
    @task = Task.new
    @task.tags.build
  end


  def edit
    @task.tags.build
  end


  def create
    @task = Task.new(task_params)

    respond_to do |format|
      if @task.save
        format.html { redirect_to @task, notice: 'Task was successfully created.' }
        format.json { render :edit, status: :created, location: @task }
      else
        format.html { render :new }
        format.json { render json: @task.errors, status: :unprocessable_entity }
      end
    end
  end

  def update
    respond_to do |format|
      if @task.update(task_params)
        format.html { redirect_to edit_task_path, notice: 'Task was successfully updated.' }
        format.json { render :edit, status: :ok, location: @task }
      else
        format.html { render :edit }
        format.json { render json: @task.errors, status: :unprocessable_entity }
      end
    end
  end

  def destroy
    @task.destroy
    respond_to do |format|
      format.html { redirect_to tasks_url, notice: 'Task was successfully destroyed.' }
      format.json { head :no_content }
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_task
      @task = Task.find(params[:id])
    end

    def task_params
      params.require(:task).permit(:task_name, :task_sum, :status_id, :user_id, :target_release_id, tag_attributes: [:tag_text, :task_id])
    end
  end

There is a tag parameter getting passed, you can see it here: - "tag"=>{"tag_text"=>"222"}}, - But you are not permitting the ":tag" in the params. Add :tag to the params and it should work. — Rockwell Rice
it doesn't help... Also please see my comment to @ajeferson answer below — si13n

alanpaivaa alanpaivaa · Accepted Answer · 2017-04-03T16:09:39

I think the problem is in the way you use fields_for. Try to make this way:

<%= f.fields_for :tags do |t| %>

That way the param tags_attributes will be send and every thing should be fine.

EDIT

Also, if you are using Rails 5, you need to set the belongs_to as optional so the accepts_nested_attributes_for can work properly. So:

class Tag < ActiveRecord::Base
    belongs_to :task, optional: true
end

And the parameters sanitization in your tasks_controller.rb you do not need tag_id under tags_attributes:

def task_params:
    params.require(:task).permit(:task_name, tags_attributes: [:tag_text])
end

EDIT

I think I found your problem. Try to put tags_attributes instead of tag_attributes in your task_paramsmethod.

Unpermitted parameter using fields_for Rails

1 Answers