设计：不允许的参数

Question

I don't know why, but the following code just stopped working (I didn't even notice how it happened)

routes.rb

devise_for :users, components: {registrations: 'registrations', sessions: 'sessions'}

registations_controller.rb

class RegistrationsController < Devise::RegistrationsController
  before_filter :configure_permitted_parameters

  def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_up).push(:name, :surname, :username, :email, :avatar)
    devise_parameter_sanitizer.for(:account_update).push(:name, :surname, :email, :avatar)
  end

end

As I said, everything worked fine before, but now I'm getting:

Processing by Devise::RegistrationsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"lvuPOmTRqv6XUQ/O1g4Q9VNvzD7DgGCHocY/OlAvKHEIvWAHvlS982hxSZZzzAESCpmL5QTUcTLw/c9ME/sUFQ==", "user"=>{"name"=>"John", "surname"=>"Doe", "username"=>"foobar", "email"=>"foobar@example.com", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Register"}
Unpermitted parameters: name, surname, email

Cofiguration:

• Rails 4.2.5
• Devise 3.5.6

PS: Now I finally understand why should I cover my code with unit-tests and use Travis CI

Answer 1

The for method has been deprecated since 4.1. Use this instead:

class ApplicationController < ActionController::Base    
  before_action :configure_permitted_parameters, if: :devise_controller?

  protected

  def configure_permitted_parameters
    attributes = [:name, :surname,:username, :email, :avatar]
    devise_parameter_sanitizer.permit(:sign_up, keys: attributes)
    devise_parameter_sanitizer.permit(:account_update, keys: attributes)
  end
end

Answer 2

I think you should try "configure_permitted_parameters" method in application controller instead of registration controller.

class ApplicationController < ActionController::Base

 before_action :configure_permitted_parameters, if: :devise_controller?

 protected

 def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_up).push(:name, :surname,:username, :email, :avatar)
    devise_parameter_sanitizer.for(:account_update).push(:name, :surname, :email, :avatar)
 end
end

Answer 3

along the 4.5.0 documentation:

In case you want to permit additional parameters (the lazy way™), you can do so using a simple before filter in your ApplicationController:

class ApplicationController < ActionController::Base
  before_action :configure_permitted_parameters, if: :devise_controller?

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
  end
end

works for me (with Rails 5.2.1).

With nested parameters (untested):

nested attributes (say you're using accepts_nested_attributes_for), then you will need to tell devise about those nestings and types:

class ApplicationController < ActionController::Base
  before_action :configure_permitted_parameters, if: :devise_controller?

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up, keys: [:first_name, :last_name, 
           address_attributes: [:country, :state, :city, :area, :postal_code]])
  end
end

Answer 4

I also experienced this issue while using the Devise gem. It was caused because I added an email_confirmation parameter to the users model in my Rails application without whitelisting the parameter in the users_controller .

Here's how I solved it:

1. Simply open the users_controller
2. Add the email_confirmation parameter to the list of permitted parameters in the users_params action.
3. Save and then reload your browser.

That's all.

I hope this helps