I’m getting this really weird error when I submit my nested form. Can’t mass-assign

Question

0

Editorial Team

Asked: June 15, 20262026-06-15T10:03:01+00:00 2026-06-15T10:03:01+00:00

I’m getting this really weird error when I submit my nested form. Can’t mass-assign

0

I’m getting this really weird error when I submit my nested form.

Can't mass-assign protected attributes: _destroy

Any idea why this may be? It’s a bit of a concern as I’m having to remove the ‘destroy’ hidden_field with javascript temporarily until i figure out what it is, meaning i can’t delete anything!

_form.html.erb

<%= nested_form_for(@post, :html=> {:multipart => true, :class=> "new_blog_post", :id=> "new_blog_post"}) do |f| %>

 <%= field do %>
    <%= f.text_field :title, placeholder: "Give your post a title", :class=>"span12" %>
 <% end %>

 <%= field do %>
    <%= f.text_area :body, placeholder: "Write something here...", :id=>"blog-text", :class=>"span12" %>
 <% end %>

 <%= f.label :search_locations, "Add locations to your post" %>
    <%= text_field_tag :name,"",:class=>"localename", :id=>"appendedInput", :placeholder=> "Name of the location", :autocomplete => "off" %>
    <%= f.link_to_add "Add a location", :locations %>

 <%= actions do %>
   <%= f.submit "Submit", :class=>"btn", :disable_with => 'Uploading Image...' %>

<% end end%>

_posts_controller.rb_

class PostsController < ::Blogit::ApplicationController   

...   

def new
  @post = current_blogger.blog_posts.new(params[:post])
  @location = @post.locations.build

end



def edit
  @post = Post.find(params[:id])
  #@post = current_blogger.blog_posts.find(params[:id]) removed so any use can edit any post
  @location = @post.locations.build
end



def create
   location_set = params[:post].delete(:locations_attributes) unless params[:post][:locations_attributes].blank?

   @post = current_blogger.blog_posts.new(params[:post])

   @post.locations = Location.find_or_initialize_location_set(location_set) unless location_set.nil?


 if @post.save
    redirect_to @post, notice: 'Blog post was successfully created.'
  else
    render action: "new"
  end
end


def update
  @post = current_blogger.blog_posts.find(params[:id])
  if @post.update_attributes(params[:post])
    redirect_to @post, notice: 'Blog post was successfully updated.'
  else
    render action: "edit"
  end
end

def destroy
  @post = current_blogger.blog_posts.find(params[:id])
  @post.destroy
  redirect_to posts_url, notice: "Blog post was successfully destroyed."
end

location.rb

class Location < ActiveRecord::Base
  after_save { |location| location.destroy if location.name.blank? }

  has_many :location_post
  has_many :posts, :through => :location_post
  has_many :assets

   attr_accessible :latitude, :longitude, :name, :post_id, :notes, :asset, :assets_attributes
    accepts_nested_attributes_for :assets, :allow_destroy => true
    include Rails.application.routes.url_helpers


  def self.find_or_initialize_location_set(location_set)
   locations = []
   locations = locations.delete_if { |elem| elem.flatten.empty? }
   location_set.each do |key, location|

    locations << find_or_initialize_by_name(location)
  end
     locations
  end

 end

EDIT:

Snippet of rendered form in new.html.erb

    <div class="row span locsearch">      
       <div class="input-append span3">

        <input autocomplete="off" class="localename" id="appendedInput" name="name" placeholder="Name of the location" type="text" value="">


        <span class="add-on"><input id="post_locations_attributes_0__destroy" name="post[locations_attributes][0][_destroy]" type="hidden" value="false"><a href="javascript:void(0)" class="remove_nested_fields" data-association="locations"><i class="icon-trash"></i></a></span>  </div>

<div class="latlong offset3 span4"> <p class="help-block">Enter the name of the town or city visited in this blog entry.</p>
        </div>

        <input class="LegNm" id="post_locations_attributes_0_name" name="post[locations_attributes][0][name]" type="hidden" value="Dresden">
        <input class="long" id="post_locations_attributes_0_longitude" name="post[locations_attributes][0][longitude]" type="hidden" value="13.7372621">
        <input class="lat" id="post_locations_attributes_0_latitude" name="post[locations_attributes][0][latitude]" type="hidden" value="51.0504088">

    </div>  
</div>

EDIT2:

post.rb

class Post < ActiveRecord::Base

require "acts-as-taggable-on"
require "kaminari"

acts_as_taggable    

self.table_name = "blog_posts"

self.paginates_per Blogit.configuration.posts_per_page

# ==============
# = Attributes =
# ==============
attr_accessible :title, :body, :tag_list, :blogger_id, :coverphoto, :locations_attributes



# ===============
# = Photo Model =
# ===============



    has_attached_file :coverphoto,
                :styles => {
                  :coverbar => "600x300>", :medium => "250x250^" , :thumb => "100x100^"},
                  #:source_file_options =>  {:all => '-rotate "-90>"'},
                  :storage => :s3,
                  :s3_credentials => "#{Rails.root}/config/s3.yml",
                  :bucket => "backpackbug",
                  :path => "/:style/:id/:filename"                


# ===============
# = Validations =
# ===============

validates :title, presence: true, length: { minimum: 6, maximum: 66 }
validates :body,  presence: true, length: { minimum: 10 }
validates :blogger_id, presence: true



# =================
# = Associations =
# =================    

belongs_to :blogger, :polymorphic => true
has_many :location_post
has_many :locations, :through => :location_post
belongs_to :profile
accepts_nested_attributes_for :locations, :allow_destroy => true, :reject_if => proc { |attributes| attributes['name'].blank? }

end end