Ruby On Rails: Parameters - Permitted: false

Question

I'm having issues with a form in my Rails 6 application.

I have a remote form which enters new data into the database via a JSON request, which works but only with one parameter. This is the form:

<%= form_with(method: :post, remote: true, model: Meal.new, url: meals_path, class: "editMealsForm", data: { type: "json" }) do |f| %>
    <div class="field">
        <%= f.label :description, 'Beschreibung' %><br>
        <%= f.text_area :description, rows: "4", placeholder: "Noch keine Mahlzeit für diesen Tag vorhanden, bitte eintragen!", class: "form-control" %>
    </div>
    <div class="field">
        <%= f.label :allergene_ids_add, 'Allergene auswählen', class: "card-text" %><br>
        <%= select_tag :allergene_ids_add, options_from_collection_for_select(@allergenes, :id, :name), multiple: true, class: "selectpicker", data: { style: "btn-success", width: "fit", live_search: "true", size: "5", title: "Allergien wählen" } %>
    </div>

    <% f.hidden_field :day, :value => local_assigns[:mealDay] %>
    <% f.hidden_field :tip, :value => "Vollkost" %>

    <%= f.submit "Speichern", class: "btn btn-primary mt-2 btn-block" %>
<% end %>

And these are my permitted parameters:

def meal_params
  params.require(:meal).permit(:day, :tip, :description, allergene_ids_add: [])
end

And this is my controller action:

def create
    @meal = Meal.new(meal_params)
    byebug
    if @meal.save
      if params[:allergene_ids_add].present?
        @allergenes_to_add = Allergene.find(params[:allergene_ids_add])
        @allergenes_to_add.each do |allergene|
          @meal.allergenes << allergene
        end
      end
      respond_to do |format|
        format.html { redirect_to meals_path }
        format.json { render json: @meal }
      end
    end
  end

The problem is, that if I hit the create action, just the description parameter is permitted, the other ones are just "ignored", so if I fire the submit button I get the following output in the console if I hit my byebug breakpoint:

And if I look at the params:

<ActionController::Parameters {"authenticity_token"=>"derBZeirq0bwr/FWoYRr97qUZ5p66vQc+uT+UMf5xjXXTSFEp+XOepJtGrckguGh+skWXTZ9ibHWfFTt3p80Cg==", "meal"=><ActionController::Parameters {"description"=>"test"} permitted: false>, "commit"=>"Speichern", "controller"=>"meals", "action"=>"create"} permitted: false>

Or just at the meal params:

<ActionController::Parameters {"description"=>"test"} permitted: true>

If I run @meal.valid? it returns true, so I don't see where the issue is.

Also if I check the values for the hidden fields in the form, they are filled and not nil.

So why does this one parameter work, but the rest just isn't permitted even if I got them in my meal_params method?

Answer 1

Okay, I am dumb. I just forgot the = for the hidden fields.

So instead of:

<% f.hidden_field :day, :value => local_assigns[:mealDay] %>
<% f.hidden_field :tip, :value => "Vollkost" %>

it should be:

<%= f.hidden_field :day, :value => local_assigns[:mealDay] %>
<%= f.hidden_field :tip, :value => "Vollkost" %>

Then everything is working.