未经允许的参数嵌套窗体 - Ruby On Rails

Question

我遵循Michael Hartl的教程，现在我想将照片添加到micropost中。但是，当我提交microposts，图像不保存在数据库和dvlpmt日志中，我可以读取未经许可的参数：图片 我有看其他帖子，做了他们的建议，但它不适用于我。

MODELS

micropost.rb

class Micropost < ActiveRecord::Base 
    belongs_to :user 
    has_one :photo 
    default_scope -> { order('created_at DESC') } 
    validates :content, presence: true, length: { maximum: 140 } 
    validates :user_id, presence: true 
end 

photo.rb

class Photo < ActiveRecord::Base 
    belongs_to :micropost 
    has_attached_file :image 
end 

CONTROLLERS

photos_controller.rb

class PhotosController < ApplicationController 
    before_action :signed_in_user, only: [:create, :destroy, :index] 

    def create 
    @photo = Photo.new(photo_params) 

    respond_to do |format| 
     if @photo.save 
     format.html { redirect_to @photo, notice: 'Photo was successfully created.' } 
     format.json { render action: 'static_pages/home', status: :created, location: @photo } 
     else 
     format.html { render action: 'static_pages/home' } 
     format.json { render json: @photo.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    private 
    def photo_params 
     params.require(:photo).permit(:image) 
    end 
end 

microposts_controller.rb

class MicropostsController < ApplicationController 
    before_action :signed_in_user, only: [:create, :destroy] 

    def create 
    @micropost = current_user.microposts.build(micropost_params) 
    if @micropost.save 
     flash[:success] = "Micropost created!" 
     redirect_to root_url 
    else 
     @feed_items = [] 
     render 'static_pages/home' 
    end 
    end 

    private 

    def micropost_params 
    params.require(:micropost).permit(:content, photo_attributes: [:photo_id, :image]) 
    end 
end 

VIEWS

_micropost_form.html.erb 我不知道如何建设小康这种形式，我已经尝试了很多不同的配方

<%= form_for(@micropost) do |f| %> 
    <%= render 'shared/error_messages', object: f.object %> 
    <div class="field"> 
    <%= f.text_area :content, placeholder: "Compose new micropost..." %> 
    </div> 

    <%= f.fields_for :image, :html => { :multipart => true } do |builder| %> 
    <%= f.file_field :image, :f => builder %> 
    <% end %> 

    <%= f.submit "Post", class: "btn btn-large btn-primary" %> 
<% end %> 

而且，当我想提交我的形式，它是确定的，但列“photo_id”为空表微柱。并且照片不会保存在数据库中。

Server日志

Started POST "/microposts" for 127.0.0.1 at 2013-11-27 15:06:06 +0100 
Processing by MicropostsController#create as HTML 
    Parameters: {"utf8"=>"✓", "authenticity_token"=>"u7MWO+E9jM8/g+6RwquQ7XLA3PR+ohQFAx0tmwNOfuY=", "micropost"=>{"content"=>"Hello world", "image"=>#<ActionDispatch::Http::UploadedFile:0x00000003401a48 @tempfile=#<Tempfile:/tmp/RackMultipart20131127-4010-1r6qt80>, @original_filename="paint.jpg", @content_type="image/jpeg", @headers="Content-Disposition: form-data; name=\"micropost[image]\"; filename=\"paint.jpg\"\r\nContent-Type: image/jpeg\r\n">}, "commit"=>"Post"} 
    [1m[36mUser Load (0.2ms)[0m [1mSELECT "users".* FROM "users" WHERE "users"."remember_token" = '342df8f039f7f40698b3691f77d2539dc8b9c101' LIMIT 1[0m 
Unpermitted parameters: image 
    [1m[35m (0.1ms)[0m begin transaction 
    [1m[36mSQL (0.4ms)[0m [1mINSERT INTO "microposts" ("content", "created_at", "updated_at", "user_id") VALUES (?, ?, ?, ?)[0m [["content", "Hello world"], ["created_at", Wed, 27 Nov 2013 14:06:06 UTC +00:00], ["updated_at", Wed, 27 Nov 2013 14:06:06 UTC +00:00], ["user_id", 101]] 
    [1m[35m (145.1ms)[0m commit transaction 
Redirected to http://localhost:3000/ 
Completed 302 Found in 153ms (ActiveRecord: 145.7ms) 

我完全现在卡住了，谢谢你，如果你能找到的东西，可以帮助我在哪里可以找到解决方案！

Answer 1

您需要在您的Micropost课程中使用accepts_nested_attributes_for。

class Micropost < ActiveRecord::Base 
    belongs_to :user 
    has_one :photo 
    accepts_nested_attributes_for :photo 
    default_scope -> { order('created_at DESC') } 
    validates :content, presence: true, length: { maximum: 140 } 
    validates :user_id, presence: true 
end 

它也看起来像你的形式是关联图像与你的微博，而不是微博的照片。看看fields_for的Ruby文档。你可以尝试改变你的表单的一部分？

<%= f.fields_for :photo, :html => { :multipart => true } do |photo_fields| %> 
    <%= photo_fields.file_field :image %> 
<% end %> 

如果你这样做，你需要确保你在呈现视图控制器动作叫@micropost.build_photo。

我不认为你需要在microposts_controller.rb的强参数中列出photo_id。记录保存到数据库后应该设置。

您还可以阅读building complex forms上的Rails指南。本指南讨论如何设置模型，视图和控制器来处理嵌套属性。他们对strong parameters的描述可能对检查有帮助，如果你还没有。