Rails 4 ForbiddenAttributesError-嵌套資源

Question

我的Rails 4應用程序中出現“ ForbiddenAttributesError”。 我在這里想念什么？

還有問題是，為什么沒有將“ examination_id”參數發送到請求？

請求

Started POST "/examinations/1/participations" for 127.0.0.1 at 2014-03-26 10:47:01 +0200
Processing by ParticipationsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"EuGZIXKJE9a1It6Ema5t+g07vXngQoqPMV5qQBfekfg=", "participation"=>{"user_id"=>"1", "examination_id"=>"", "language_preference"=>"İngilizce", "exam_center_preference"=>"1", "disability"=>"0"}, "commit"=>"Sınava Başvur", "examination_id"=>"1"}
  User Load (0.4ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 1 ORDER BY "users"."id" ASC LIMIT 1
  Examination Load (0.2ms)  SELECT "examinations".* FROM "examinations" WHERE "examinations"."id" = ? LIMIT 1  [["id", "1"]]
Completed 500 Internal Server Error in 5ms

ActiveModel::ForbiddenAttributesError (ActiveModel::ForbiddenAttributesError):
app/controllers/participations_controller.rb:37:in `create'

的routes.rb

resources :examinations do
  resources :participations
end

Participation.rb

class Participation < ActiveRecord::Base
  belongs_to :user
  belongs_to :examination
end

Examination.rb

class Examination < ActiveRecord::Base
  has_many :participations
  has_many :users, :through => :participations
  has_many :exam_fees, dependent: :destroy
  has_many :exam_languages, dependent: :destroy
end

participations_controller.rb

#encoding: utf-8

class ParticipationsController < ApplicationController

  before_filter :authenticate_user!
  before_action :set_participation, only: [:show, :edit, :update, :destroy]
  before_filter :get_examination

  def get_examination
    @examination = Examination.find(params[:examination_id])
  end

  # GET /participations
  # GET /participations.json
  def index
    @participations = @examination.participations
  end

  # GET /participations/1
  # GET /participations/1.json
  def show
    @participation = @examination.participations.find(params[:id])
  end

  # GET /participations/new
  def new
    @participation = Participation.new
  end

  # GET /participations/1/edit
  def edit
  end

  # POST /participations
  # POST /participations.json
  def create
    @participation = @examination.participations.new(params[:participation])
    @participation.user = current_user

    respond_to do |format|
      if @participation.save
        redirect_to @examination
        format.html { redirect_to [@examination, @participation], notice: 'Sınav Katılımınız Oluşturuldu!' }
        format.json { render action: 'show', status: :created, location: [@examination, @participation] }
      else
        render 'new'
        format.html { render action: 'new' }
        format.json { render json: @participation.errors, status: :unprocessable_entity }
      end
    end
  end

  # PATCH/PUT /participations/1
  # PATCH/PUT /participations/1.json
  def update
    respond_to do |format|
      if @participation.update(participation_params)
        format.html { redirect_to [@examination, @participation], notice: 'Sınav Katılımını Güncellendi!' }
        format.json { head :no_content }
      else
        format.html { render action: 'edit' }
        format.json { render json: @participation.errors, status: :unprocessable_entity }
      end
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_participation
      @participation = Participation.find(params[:id])
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def participation_params
      params.require(:participation).permit(:user_id, :examination_id, :payment_status, :language_preference, :exam_center_preference, :disability)
    end
end

/views/participations/_form.html.erb

<%= simple_form_for([@examination, @participation]) do |f| %>
  <%= f.error_notification %>

  <fieldset>
    <legend>Sınav Katılımı</legend>
    <%= f.input :user_id, :as => :hidden, :input_html => { :value => current_user.id } %>
    <%= f.input :examination_id, as: :hidden %>
    <%= f.input :language_preference, collection: ["Türkçe", "İngilizce", "Rusça"], label: 'Sınav Dili Tercihi' %>
    <%= f.input :exam_center_preference, collection:ExamCenter.all, label_method: :city, as: :select, label: 'Sınav Merkezi Tercihi' %>
    <%= f.input :disability, inline_label: 'Yardımcı İstiyorum', label: false %>
    <%= f.button :submit, "Sınava Başvur" %>
  </fieldset>
<% end %>

Answer 1

為了將Rails 4中的參數分配給對象，您應該使用在participation_params方法中實現的強參數“語法”，而不是直接傳遞參數。 所以換行：

@participation = @examination.participations.new(params[:participation])

至：

@participation = @examination.participations.new(participation_params)

既然你創建你的Participation ，通過協會的記錄，你並不真正需要examination_id在此控制器PARAM。 而且，如果您允許此參數，那么除了從哪個上下文中創建Participation ，將Participation分配給Examination變得很容易，我懷疑這是理想的選擇。 因此，我想您應該同時從表單中的字段和participation_params方法中刪除examination_id 。