Question

Right now I’m trying to build an app which has the ability to search for phone numbers, buy them, and record the transaction to a database.

The way I thought to do it was to have two controllers– (1) the find_numbers controller takes paramaters and searches for numbers. And (2) the phones controller buys the chosen number and saves the parameters to the database.

Here’s a diagram of what I’m trying to do.

http://www.stepanp.com/search-and-buy.jpg

With the help of a fellow stackoverflower, I was able to fix a bunch of the errors, but for some reason, when I POST from find_numbers/show to PhonesController#create, I get the error

ActiveModel::MassAssignmentSecurity::Error in PhonesController#create

Can’t mass-assign protected attributes: :original_number, :name, :twilio_number

I think it might have to do with the way my form is laid out, because the Phone Model does have attr_accessible to these values.

Here’s the find_numbers/show form

<%= @numbers.each do |number| %>

    <%= form_tag(:controller => "phones", :action => "create" ) do %>
        <%= hidden_field "phone[:original_number]", params[:original_number] %>


    <%= hidden_field "phone[:name]", params[:name] %>
        <%= hidden_field "phone[:twilio_number]",  number.phone_number %>

        <div class="found_list">
            <div class="found_phone_number">
                <%= label_tag("phone[:number]", number.friendly_name) %>
            </div>
            <div class="choose_found_number">
             <%= submit_tag("Choose This Number", :class => "btn btn-large btn-success") %>
            </div>
        </div>
            <hr>
    <% end %>
<% end %

It might have something to do with adding the phone[] around the values

Here’s the PhoneController#Create Action

def create
    @user = current_user
    @phone = @user.phones.new(params[:phone])
    client = Twilio::REST::Client.new(@user.twilio_account_sid, @user.twilio_auth_token)
    number = client.account.incoming_phone_numbers.create(
                   :phone_number => params[:twilio_number])
    if @phone.save && number.present?
      flash[:success] = "Phone Number Created!"
      redirect_to user_path
    else
      render new_find_number_path
      flash[:error] = "It looks like there were errors with the submission"
    end
end

And here’s the Phone Model

# == Schema Information
#
# Table name: phones
#
#  id              :integer          not null, primary key
#  name            :string(255)
#  twilio_number   :string(255)
#  original_number :string(255)
#  user_id         :integer
#  created_at      :datetime         not null
#  updated_at      :datetime         not null
#

class Phone < ActiveRecord::Base

  attr_accessible :original_number, :user_id, :name, :twilio_number
  belongs_to :user

  validates :name, presence: true
  validates :twilio_number, presence: true
  validates :original_number, presence: true
  validates :user_id, presence: true

  default_scope order: 'phones.created_at DESC'

end

I think the “phone[:attribute]” in the form has something to do with this — though if we didn’t put it that way, for some reason the create action would not understand that the :name attribute that was POSTED was for the phone model.

Any help on this would be greatly appreciated

Answer 1

I couldn’t figure out why this was happening, but I avoided it all together by rendering phones/new instead, and using form_for(@phone) rather than form_tag