Rails：动态简单表单的 ForbiddenAttributesError

Question

我按照答案given here 创建了一个简单的动态表单（不是嵌套的）。这个想法是用他们的电子邮件邀请几个人。然后我有一个“添加团队成员”按钮来添加字段以输入同事电子邮件。

我收到以下错误，但我不知道为什么：

InvitationsController#create 中的 ActiveModel::ForbiddenAttributesError

参数：

{"utf8"=>"✓",
 "authenticity_token"=>"zLs8DWkzO+bPc2jGhFptgc+BAGAwzr1kcn/hkX/6vQbQ/cDCzuqoGCMGUTcYHs+up7nBzHFiEXVcKustyL1KIA==",
 "invitation"=>[{"email"=>"test@test.fr", "_destroy"=>"false", "user_id"=>"1"}, {"email"=>"test2@test2.fr", "_destroy"=>"false", "user_id"=>"1"}],
 "commit"=>"Save Team Members"}

我在控制器中的创建操作和invitation_params：

def create
    puts params[:invitation].to_yaml
    params[:invitation].each do |invitation_params|
     Invitation.create(invitation_params)
    end
    redirect_to invitation_path
  end

def invitation_params
      params.require(:invitation).permit(:id, :email, :user_id, :_destroy, :token)
    end

我的表格：

<%= form_for(invitation) do |f| %>
  <% if invitation.errors.any? %>
    <div id="error_explanation">
      <h2><%= pluralize(invitation.errors.count, "error") %> prohibited this invitation from being saved:</h2>

      <ul>
      <% invitation.errors.full_messages.each do |message| %>
        <li><%= message %></li>
      <% end %>
      </ul>
    </div>
  <% end %>

  <div id="container_invitations"></div>

  <%= link_to "Add a New Team Member", add_invitation_path, :method => :post, :remote => true %>

  <div class="actions">
    <%= f.submit "Save Team Members", class: "cta2" %>
  </div>
<% end %>

add_invitation 控制器动作（动态添加字段）：

def add_invitation
    respond_to do |format|
      format.js
    end
  end

add_invitation.js.erb：

$('#container_invitations').append("<%= escape_javascript(render :partial => 'invitation_fields_render') %>");
$('.remove_fields').on('click', function(e) {
  $(this).parent().remove();
});

_invitation_fields_render.html.erb（带有字段的部分）

<div class="new_invitation_row">
 <%= email_field_tag "invitation[][email]", nil, placeholder: "Team Member Email", :required => 'required' %>
 <%= hidden_field_tag "invitation[][_destroy]", nil, value: false %>
 <a class="remove-link remove_fields dynamic" href="#"><i class="fa fa-trash fa-lg" title="Remove"></i></a>
 <%= hidden_field_tag "invitation[][user_id]", nil, value: current_user.id %>
</div>

我的邀请模型：

class Invitation < ActiveRecord::Base
  has_secure_token

  belongs_to :user
end

谢谢。

更新

我添加了 IngoAlbers 提出的新 params.permit 行。我仍然得到错误。这是错误的完整堆栈跟踪：

于 2017-12-01 07:49:02 +0000 为 127.0.0.1 开始 POST "/invitations" InvitationsController#create 作为 HTML 参数处理： {"utf8"=>"✓", "authenticity_token"=>"pV5wQj3QHXksNEtJ8nZSjWDc8VyHiewVCt4A1+ijH8G5GIyNmgmOh8BBcrhuMvCiCOQw8MYlQAQkiwprX+To5w==", "邀请"=>[{"email"=>"test@test.fr", "_destroy"=>"false", "user_id"=>"1"}], "commit"=>"Save Team Members"} 用户负载（0.4ms） SELECT "users".* FROM "users" WHERE "users"."id" = ?订购方式 “用户”。“ID” ASC 限制？ [["id", 1], ["LIMIT", 1]] CoreBot 加载 (0.2ms) SELECT "core_bots".* FROM "core_bots" WHERE "core_bots"."id" = ?限制 ？ [["id", 1], ["LIMIT", 1]] Completed 500 Internal Server Error in 4ms (ActiveRecord: 0.6ms)

ActiveModel::ForbiddenAttributesError (ActiveModel::ForbiddenAttributesError):
app/controllers/invitations_controller.rb:35:in block in create' app/controllers/invitations_controller.rb:34:ineach' app/controllers/invitations_controller.rb:34:in `create' 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb 在救援/布局内渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_source.html.erb 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_source.html.erb (5.3ms) 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb (2.5ms ) 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb (1.5ms) 渲染 /Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb 在救援/布局内 (93.1ms)

Answer 1

问题在于invitation 是一个数组。所以你实际上需要允许invitation_params中的数组。

def invitation_params
  params.permit(invitation: [:id, :email, :user_id, :_destroy, :token])
end

此外，您的创建操作本身存在问题。 您实际上并未使用已定义的允许参数。 它应该看起来像这样：

def create
  invitation_params[:invitation].each do |invitation|
    Invitation.create(invitation)
  end

  redirect_to invitation_path
end