Question

Possible Duplicate:
Can't mass assign protected attributes

my resource tree:

camrade has_many resumes 
resumes has_many experiences 
experience belongs_to company

camrade and resumes and experiences nests each other.

I want to change all this on one page. in controller I have string:

  @camrade.update_attributes(params[:camrade])

From view after submit comes this params:

"camrade"=>{
    "resumes_attributes"=>{
      "0"=>{
        "title"=>"first",
        "id"=>"4"},
      "1"=>{
        "title"=>"second",
        "experiences_attributes"=>{
          "1344617107870"=>{
            "company_name"=>"Some company"
          }
        }
      }
    }
  }

Because Experience does not have company_name, I wrote this way:

    class Experience < ActiveRecord::Base
      belongs_to :company
      def company_name
        company.try(:name)
      end
      def company_name=(name)
        self.company = Company.find_or_create_by_name(name) if name.present?
      end
    end

But still an error “Can’t mass-assign protected attributes: company_name” occurs.

Answer 1

Add attr_accessible :company_name to your Experience model. Your updated code should be something like:

class Experience < ActiveRecord::Base
  attr_accessible :company_name
  belongs_to :company

  def company_name
    company.try(:name)
  end

  def company_name=(name)
    self.company = Company.find_or_create_by_name(name) if name.present?
  end
end

You can read more about Rails’s mass-assignment protection here:
http://guides.rubyonrails.org/security.html#mass-assignment