WARNING: Can't mass-assign these protected attributes: active

[João Pereira]

Hi, 

I'm trying to understand this error:

WARNING: Can't mass-assign these protected attributes: active

I had this error before when creating a record.I did not mark the attibutes posted from the form as attr_accessible, so when the following line tries to execute it throwed an Warning in the log, and the record was not saved. 

@user = User.new(params[:user])

I find out that I have to have the attributes that I want to sent from the form marked as attr_accessible. But now I'm not understanding the same error when I try to update a single parameter from the record.

Let's say I have this in my users controller:

#Get from the params hash the activation key

activation_key = params[:activation_key]

#Get from the params Hash the user id

user_id =params[:id]    

@user = User.find(user_id)

@user.update_attributes!(:active=>1)

and in the model I don't have the param active :marked as attr_accessible. And the following warning messages is logged and the record is not updated

WARNING: Can't mass-assign these protected attributes: active

Shouldn't this work without having the :param active marked with attr_accessible?

     

 

[Frederick Cheung]

On Nov 22, 2:46 am, João Pereira <jonhy.p...@gmail.com> wrote:
> user_id =params[:id]
> @user = User.find(user_id)
> @user.update_attributes!(:active=>1)
>
> and in the model I don't have the param active :marked as attr_accessible.
> And the following warning messages is logged and the record is not updated
>
> WARNING: Can't mass-assign these protected attributes: active
>
> Shouldn't this work without having the :param active marked with
> attr_accessible?

No - update_attributes, new etc. all behave the same way with respect
to protected attributes.

Fred

[Matt Jones]

On Nov 21, 9:46 pm, João Pereira <jonhy.p...@gmail.com> wrote:
> @user.update_attributes!(:active=>1)
>
> and in the model I don't have the param active :marked as attr_accessible.
> And the following warning messages is logged and the record is not updated
>
> WARNING: Can't mass-assign these protected attributes: active
>
> Shouldn't this work without having the :param active marked with
> attr_accessible?

You're still doing mass-assignment, just not with much "mass". The
function you're looking for is either @user.update_attribute(:active,
true) or just @user.active = true followed by @user.save.

--Matt Jones