ruby-on-rails - Rails 4 ForbiddenAttributesError - 嵌套资源

Question

我的 Rails 4 应用程序中出现“ForbiddenAttributesError”。我在这里缺少什么？

还有一个问题是，为什么没有将“examination_id”参数发送到请求中？

请求

Started POST "/examinations/1/participations" for 127.0.0.1 at 2014-03-26 10:47:01 +0200
Processing by ParticipationsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"EuGZIXKJE9a1It6Ema5t+g07vXngQoqPMV5qQBfekfg=", "participation"=>{"user_id"=>"1", "examination_id"=>"", "language_preference"=>"İngilizce", "exam_center_preference"=>"1", "disability"=>"0"}, "commit"=>"Sınava Başvur", "examination_id"=>"1"}
  User Load (0.4ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 1 ORDER BY "users"."id" ASC LIMIT 1
  Examination Load (0.2ms)  SELECT "examinations".* FROM "examinations" WHERE "examinations"."id" = ? LIMIT 1  [["id", "1"]]
Completed 500 Internal Server Error in 5ms

ActiveModel::ForbiddenAttributesError (ActiveModel::ForbiddenAttributesError):
app/controllers/participations_controller.rb:37:in `create'

Routes.rb

resources :examinations do
  resources :participations
end

参与.rb

class Participation < ActiveRecord::Base
  belongs_to :user
  belongs_to :examination
end

考试.rb

class Examination < ActiveRecord::Base
  has_many :participations
  has_many :users, :through => :participations
  has_many :exam_fees, dependent: :destroy
  has_many :exam_languages, dependent: :destroy
end

participations_controller.rb

#encoding: utf-8

class ParticipationsController < ApplicationController

  before_filter :authenticate_user!
  before_action :set_participation, only: [:show, :edit, :update, :destroy]
  before_filter :get_examination

  def get_examination
    @examination = Examination.find(params[:examination_id])
  end

  # GET /participations
  # GET /participations.json
  def index
    @participations = @examination.participations
  end

  # GET /participations/1
  # GET /participations/1.json
  def show
    @participation = @examination.participations.find(params[:id])
  end

  # GET /participations/new
  def new
    @participation = Participation.new
  end

  # GET /participations/1/edit
  def edit
  end

  # POST /participations
  # POST /participations.json
  def create
    @participation = @examination.participations.new(params[:participation])
    @participation.user = current_user

    respond_to do |format|
      if @participation.save
        redirect_to @examination
        format.html { redirect_to [@examination, @participation], notice: 'Sınav Katılımınız Oluşturuldu!' }
        format.json { render action: 'show', status: :created, location: [@examination, @participation] }
      else
        render 'new'
        format.html { render action: 'new' }
        format.json { render json: @participation.errors, status: :unprocessable_entity }
      end
    end
  end

  # PATCH/PUT /participations/1
  # PATCH/PUT /participations/1.json
  def update
    respond_to do |format|
      if @participation.update(participation_params)
        format.html { redirect_to [@examination, @participation], notice: 'Sınav Katılımını Güncellendi!' }
        format.json { head :no_content }
      else
        format.html { render action: 'edit' }
        format.json { render json: @participation.errors, status: :unprocessable_entity }
      end
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_participation
      @participation = Participation.find(params[:id])
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def participation_params
      params.require(:participation).permit(:user_id, :examination_id, :payment_status, :language_preference, :exam_center_preference, :disability)
    end
end

/views/participations/_form.html.erb

<%= simple_form_for([@examination, @participation]) do |f| %>
  <%= f.error_notification %>

  <fieldset>
    <legend>Sınav Katılımı</legend>
    <%= f.input :user_id, :as => :hidden, :input_html => { :value => current_user.id } %>
    <%= f.input :examination_id, as: :hidden %>
    <%= f.input :language_preference, collection: ["Türkçe", "İngilizce", "Rusça"], label: 'Sınav Dili Tercihi' %>
    <%= f.input :exam_center_preference, collection:ExamCenter.all, label_method: :city, as: :select, label: 'Sınav Merkezi Tercihi' %>
    <%= f.input :disability, inline_label: 'Yardımcı İstiyorum', label: false %>
    <%= f.button :submit, "Sınava Başvur" %>
  </fieldset>
<% end %>

Answer 1

为了在 Rails 4 中将参数分配给对象，您应该使用在 participation_params 方法中实现的强参数“语法”，而不是直接传递参数。所以换行:

@participation = @examination.participations.new(params[:participation])

到:

@participation = @examination.participations.new(participation_params)

由于您通过关联创建了您的参与 记录，因此您实际上不需要此 Controller 中的examination_id 参数。更重要的是，如果您允许此参数，则很容易将 Participation 分配给 Examination，而不是从您创建 Participation 的上下文中，我对此表示怀疑是可取的。所以我想你应该从表单的字段和 participation_params 方法中删除 examination_id。