Question

I am trying to edit a Topic which has many Posts.
Edit page for a Topic has Topic’s name and Post’s content that can be edited.

The mass-assignment error occurs in topics_controller.rb, update method, post.update_attributes(params[:post]).

How do I avoid mass-assignment error.

topic.rb

class Topic < ActiveRecord::Base
  has_many :posts, :dependent => :destroy
  belongs_to :forum
  accepts_nested_attributes_for :posts, :allow_destroy => true
  attr_accessible :name, :last_post_id, :posts_attributes
end

post.rb

class Post < ActiveRecord::Base
  belongs_to :topic
  attr_accessible :content
end

topics_controller.rb

def update
  @topic = Topic.find(params[:id])
  post = @topic.posts.first
  if @topic.update_attributes(params[:topic]) && post.update_attributes(params[:post])
    topic = Topic.find(@post.topic_id)
    flash[:success] = "Success!"
    redirect_to topic_posts_path(topic)
  else
    render 'edit'
  end
end

views/topics/edit.html.erb

<%= form_for @topic do |f| %>
  <!-- render 'shared/error_messages_topic' -->

  <%= f.label :name %>
  <%= f.text_field :name %>

  <%= f.fields_for @topic.posts.first do |post| %>
    <%= render :partial => "posts/form", :locals => {:f => post} %>
  <% end %>


  <%= f.submit "Edit", class: "btn btn-large btn-primary" %>
<% end %>

views/posts/_form.html.erb

<%= f.label :content %>
<%= f.text_area :content %>

Answer 1

In update method you don’t have to update attributes of both the models instead of if @topic.update_attributes(params[:topic]) && post.update_attributes(params[:post]) it should this only if @topic.update_attributes(params[:topic]) it will update the posts automatically.

And change your view from this <%= f.fields_for @topic.posts.first do |post| %> to <%= f.fields_for :posts, @topic.posts.first do |post| %> it will work fine.

For more information read this http://api.rubyonrails.org/classes/ActionView/Helpers/FormHelper.html#method-i-fields_for