Question

I have three models: User, Post and, Reply. An user has many posts and comments. A post had many replies and belongs to an user, and a reply belongs to a post and an user.

routes.rb:

resources :posts do
  resources :replies
end

schema.rb:

  create_table "posts", :force => true do |t|
    t.text     "content",    :limit => 255
    t.integer  "user_id"
    t.datetime "created_at",                :null => false
    t.datetime "updated_at",                :null => false
    t.string   "title"
  end

  create_table "replies", :force => true do |t|
    t.text     "content"
    t.integer  "post_id"
    t.integer  "user_id"
    t.datetime "created_at", :null => false
    t.datetime "updated_at", :null => false
  end

This is how I’m creating comments:

comments_controller.rb:

 def create
    @post = Post.find(params[:post_id])
    @reply = @post.replies.build(params[:reply])
    if @reply.save!
      flash[:success] = "reply created!"
      redirect_to post_path(@post)
    else
      redirect_to post_path(@post)
    end
  end

replies/_form.html.erb:

<%= form_for([@post, @post.replies.build]) do |f| %>
  <%= render 'shared/error_messages', object: f.object %>
  <div class="field">
    <%= f.text_area :content, placeholder: "Enter reply content" %>
  </div>
  <%= f.submit "Reply", class: "btn btn-large btn-primary" %>
<% end %>

After submitting the form I get this error:

Validation failed: User can't be blank

I assume its because the reply’s attribute user_id is empty:

reply.rb

validates :user_id, presence: true

I’m not sure how to fill that attribute. I can’t just put it in Reply attr_accesible, because that would compromise the security of the app (as far as I know).

Any suggestions to solve this?

Answer 1

attr_acessible only affects things when you’re updating/creating a record from a hash of attributes. You can always set an attribute by calling the accessor directly, so after you’ve built the reply,

@reply.user = current_user

Should do the trick (assuming you’re using something like devise or authlogic that defined current_user for you. You could also assign to @reply.user_id directly.