Rails 5 Permitting controller action changed params

Question

So i have the following params permitted.

p = params.permit(:a, :b, :c, :lines => [:location_id, :quantity, :product => [:id]])

In my controller action, i add to the lines param the data i've permitted.

p['lines'] << {"product"=>{"id"=>"123456"}, "quantity"=>"2", "location_id"=>"123456"}

This is how the params looked after they've been changed.

puts params['lines']
#> [<ActionController::Parameters {"product"=>{"id"=>"123456"}, "quantity"=>"2", "location_id"=>"123456"} permitted: false>]

But as you can see it's not permitted. What am i missing here? I am using Rails 5.

Can you please post your code as it is called - on just line by line. Because at the moment I understand that you add values to the hash after you called permit. And that wouldn't work. Furthermore, why do you need to add something to the params. What do you try to achieve? — spickermann

Wasif Hossain Wasif Hossain · Accepted Answer · 2017-11-10T19:31:23

To get permitted (whitelisted) params, you always have to make sure that you call the permitted version, p in your case, whenever params changes.

The difference between params and p is that params.permit(...) returns a permitted copy of itself and assigns it to p. So params permission state remains unchanged.

Try with puts p['lines'] instead of puts params['lines'] to see if you get the desired result.

Rails 5 Permitting controller action changed params

1 Answers