ActiveModel::MassAssignmentSecurity::Error in SchedulesController#create

Question

im trying to declare some virtual attributes that will be used to combine date and time together given me date time, though i keep getting the following error. as you can see from the code examples below, how im setting the attributes, and what information im passing through to them.

ActiveModel::MassAssignmentSecurity::Error in SchedulesController#create

{"utf8"=>"✓",


"authenticity_token"=>"j4V6DAqK5U/+ZGaSKDlrEoOBqXu3pEq/FM51ingi2sg=",
 "schedule"=>{"event"=>"1",
 "result_id"=>"",
 "date"=>"04/11/2012",
 "arrival_time"=>"08:00 PM",
 "time"=>"08:00 PM",
 "duration"=>"1800",
 "location_id"=>"11",
 "selected_players"=>["",
 "41",
 "38"],
 "team_id"=>"1",
 "opponent_id"=>"1",
 "home_or_away"=>"Home"},
 "commit"=>"Save Event"}

controller

    # POST /schedules
  # POST /schedules.json
  def create
    params[:schedule].delete(:date)
    params[:schedule].delete(:time)
    @user = User.find(current_user)

    @players = User.where(:team_id => current_user[:team_id]).all
    params[:schedule][:selected_players].compact
    #params[:schedule][:selected_players].reject!{|selected_players| selected_players==""}
    #@availabilities = @user.availabilities.create(:unique_id => params[:schedule][:id])

    @schedule = Schedule.new(params[:schedule])

    respond_to do |format|
      if @schedule.save
        #Notifier.event_added(@user,@schedule).deliver
        format.html { redirect_to(schedules_url,
                                  :notice => "#{event_display_c(@schedule.event)} vs #{@schedule.opponent.name} was successfully created.") }
        format.json { render :json => @schedule, :status => :created, :location => @schedule }
      else
        format.html { render :action => "new" }
        format.json { render :json => @schedule.errors, :status => :unprocessable_entity }
      end
    end
  end

model

class Schedule < ActiveRecord::Base
  belongs_to :location
  belongs_to :opponent
  belongs_to :team
  belongs_to :result
  has_many :availabilities, :dependent => :destroy

  attr_accessible :location_id, :user_id, :opponent_id, :datetime, :score_for, :score_against, :event,
                  :team_id, :home_or_away, :arrival_time, :duration, :selected_players, :result_id

  attr_accessor :date, :time

Answer 1

figured this out for myself, just added the fields in the database in the end

Answer 2

I believe you are getting a MassAssignmentSecurity error because you are passing the virtual attributes time and date into Schedule.new when you instantiate the new schedule, and since they are not in the list of whitelisted attributes, Rails assumes they are attributes that should not be mass assigned. You should delete them from params before initiating the new schedule, and then (if needed) set the corresponding instance variables directly:

def create
  date = params[:schedule].delete(:date)
  time = params[:schedule].delete(:time)
  @schedule = Schedule.new(params[:schedule])
  @schedule.date = date
  @schedule.time = time
  ...

If you want to then set datetime from date and time when the model is saved, you should create an before_save callback to do that (maybe you already have).

Answer 3

Check the parameters which are not being made acessible. Then do this:

date = params[:schedule]
@schedule = Schedule.new(params[:schedule]) do |schedule|
  schedule.date = date
  ...
end

alternatively, you can set the mass-assignment rules to non-strict:

config.active_record.mass_assignment_sanitizer = :logger

and instead of having these exceptions, the filtered attributes will just be logged. then you can do this:

@schedule = Schedule.new(params[:schedule]) do |schedule|
  schedule = params[:schedule][:date]
  ...
end