# Nested forms and attr\_accessable **URL:** \ **Category:** Rails\ **Created:** [January 21, 2010, 10:04pm UTC](https://www.ruby-forum.com/t/nested-forms-and-attr-accessable/182035 "2010-01-21T22:04:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![byrnejb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/d2c977/32.png) [@byrnejb](https://www.ruby-forum.com/u/byrnejb)\ **Post date:** [January 21, 2010, 10:04pm UTC](https://www.ruby-forum.com/t/nested-forms-and-attr-accessable/182035/1 "2010-01-21T22:04:21Z")
Rails 2.3.5 I am working on a nested form that assigns roles to users through a table called clearances. I have attr\_acessable turned off globally in an initializer: ActiveRecord::Base.send(:attr\_accessible, nil) I have this set in clearance.rb attr\_accessible(:description, :effective\_from, :role\_id, :superceded\_after, :user\_id) And this is what params looks like after the submit button is selected: {“user”=\>{“id”=\>“146”}, “commit”=\>“Commit Changes”, “\_method”=\>“put”, “action”=\>“update”, “clearance”=\>[{“id”=\>“122”, “description”=\>“Just a test”, “effective\_from”=\>“2009-01-01”}, {“role\_id”=\>“178”, “effective\_from”=\>“2010-01-21 00:00:00 -0500”, “user\_id”=\>“146”}], “controller”=\>“user\_roles”} But this: ``` if @user.update_attributes!(params[:user]) ``` neither raises an error nor updates the rows. I have tried this with and without the attr\_accessible initializer and the results are the same ether way. I read that this should work with nested rows but I cannot determine what I might be doing wrong. Can anyone see what might be happening? ---
**Author:** ![byrnejb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/d2c977/32.png) [@byrnejb](https://www.ruby-forum.com/u/byrnejb)\ **Post date:** [January 23, 2010, 1:57pm UTC](https://www.ruby-forum.com/t/nested-forms-and-attr-accessable/182035/2 "2010-01-23T13:57:47Z")
James B. wrote: > … > And this is what params looks like after the submit button is > selected: > > {“user”=\> {“id”=\>“146”}, “commit”=\>“Commit Changes”, “\_method”=\>“put”, > “action”=\>“update”, “clearance”=\>[{“id”=\>“122”, “description”=\>“Just a > test”, “effective\_from”=\>“2009-01-01”}, {“role\_id”=\>“178”, > “effective\_from”=\>“2010-01-21 00:00:00 -0500”, “user\_id”=\>“146”}], > “controller”=\>“user\_roles”} The problem seems to be your form. The params should look like something like this: {“user”=\> {“id”=\>“146”, “clearances\_attributes”=\>[ {“id”=\>“122”, “description”=\>“Just a test”, “effective\_from”=\>“2009-01-01”}, {“role\_id”=\>“178”, “effective\_from”=\> “2010-01-21 00:00:00 -0500”, “user\_id”=\>“146”}]}, … } Regards, T. ---
**Author:** ![byrnejb](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/d2c977/32.png) [@byrnejb](https://www.ruby-forum.com/u/byrnejb)\ **Post date:** [January 22, 2010, 7:19pm UTC](https://www.ruby-forum.com/t/nested-forms-and-attr-accessable/182035/3 "2010-01-22T19:19:51Z")
I have some further trace information regarding this situation. I am really at a bit of a loss here on how to proceed. I cannot find any evidence that the update user attributes is working. This is in my User model: has\_many :roles, :through =\> :clearances has\_many :clearances accepts\_nested\_attributes\_for :clearances This is my update method: def update @user = User.find(params[:user][:id]) if @user.update\_attributes!(params[:user]) flash[:notice] = I18n.t(‘User clearance successfully updated’) # Continue adding new cleartnaces until admin exits from page. redirect\_to new\_user\_role\_path(@user) else #TODO: Should this be a redirect\_back action instead? redirect\_back format.html { render :action =\> :‘edit’ } format.xml { render :xml =\> @clearance.errors, :status =\> :unprocessable\_entity } end This is what the params hash looks like in the update: Update params hash contains: {“user”=\>{“id”=\>“3”}, “commit”=\>“Commit Changes”, “\_method”=\>“put”, “action”=\>“update”, “clearance”=\> [{“id”=\>“2”, “description”=\>“Just a test”, “effective\_from”=\>“2009-01-01”}, {“role\_id”=\>“5”, “effective\_from”=\>“2010-01-22 00:00:00 -0500”, “user\_id”=\>“3”}], “controller”=\>“user\_roles”} And this is the SQL generated: User Load (1.2ms) SELECT \* FROM “users” WHERE (“users”.“id” = 3) WARNING: Can’t mass-assign these protected attributes: id SQL (0.6ms) SAVEPOINT active\_record\_1 User Load (1.5ms) SELECT “users”.id FROM “users” WHERE (“users”.“username” = E’xtra\_user’ AND “users”.id \<\> 3) LIMIT 1 User Load (1.2ms) SELECT “users”.id FROM “users” WHERE (“users”.“email” = E’removed\_email\_address@domain.invalid’ AND “users”.id \<\> 3) LIMIT 1 User Update with optimistic locking (1.4ms) UPDATE “users” SET “changed\_at” = ‘2010-01-22 18:07:41’, “accessed\_at” = ‘2010-01-22 18:07:41’, “perishable\_token” = E’F4kMiFkscuV-yyPmBR5G’, “lock\_version” = 1 WHERE id = 3 AND “lock\_version” = 0 SQL (0.6ms) RELEASE SAVEPOINT active\_record\_1 User Load (1.4ms) SELECT \* FROM “users” WHERE (“users”.“id” = E’1’) LIMIT 1 SQL (0.6ms) SAVEPOINT active\_record\_1 User Update with optimistic locking (1.5ms) UPDATE “users” SET “changed\_at” = ‘2010-01-22 18:07:41’, “accessed\_at” = ‘2010-01-22 18:07:41’, “perishable\_token” = E’2EW-hHca03mO73cIpQdV’, “last\_request\_at” = ‘2010-01-22 18:07:41.524650’, “lock\_version” = 9 WHERE id = 1 AND “lock\_version” = 8 SQL (0.6ms) RELEASE SAVEPOINT active\_record\_1 User Load (1.2ms) SELECT \* FROM “users” WHERE (“users”.“id” = 3) Role Load (1.1ms) SELECT \* FROM “roles” Role Load (1.3ms) SELECT “roles”.\* FROM “roles” INNER JOIN “clearances” ON “roles”.id = “clearances”.role\_id WHERE ((“clearances”.user\_id = 3)) SQL (1.0ms) SELECT count(_) AS count\_all FROM “clearances” WHERE (“clearances”.user\_id = 3) Clearance Load (1.0ms) SELECT \* FROM “clearances” WHERE (“clearances”.user\_id = 3) Role Load (1.1ms) SELECT \* FROM “roles” WHERE (“roles”.“id” = 4) SQL (1.2ms) SELECT count(_) AS count\_all FROM “users” WHERE (last\_request\_at \> ‘2010-01-22 17:57:41.660586’) I do not seem to be able to find any place where Clearances are inserted?