# Rails 2.0 turn on mass assignment

**URL:** <https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768>\
**Category:** Rails\
**Created:** [February 11, 2008, 12:41pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768 "2008-02-11T12:41:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 11, 2008, 12:41pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/1 "2008-02-11T12:41:39Z")

</div>

Can anyone tell me how to turn on mass assignment in rails 2.0. I am  
facing a problem accessing a value of an attr\_protected value sat by a  
plugin I am using. I need this value to be assigned to a modle object  
but it is silently discarded. Please help.

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 11, 2008, 12:48pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/2 "2008-02-11T12:48:52Z")

</div>

if it’s only one attribute, why not just assign with:

@object.update\_attribute(:attribute, value)

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 11, 2008, 12:59pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/3 "2008-02-11T12:59:24Z")

</div>

On Feb 11, 2008, at 12:40 , Nuwan Chaturanga wrote:

> Can anyone tell me how to turn on mass assignment in rails 2.0. I am  
> facing a problem accessing a value of an attr\_protected value sat by a  
> plugin I am using. I need this value to be assigned to a modle object  
> but it is silently discarded. Please help.

Protected attributes are ignored in mass-assignment, that’s the whole  
point of attr\_protected!

If the plugin sets the attribute with regular assignment it will get  
saved anyway, I mean this sequence updates the protected attribute:

```
model.protected_attribute = value
if model.update_attributes(params[:model])
  # protected was updated to value, no matter
  # what params[:model] has about it
end

```

If the plugin uses mass-assignemnt itself either the atribute cannot  
be protected or else you need to patch the plugin.

– fxn

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 11, 2008, 3:35pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/4 "2008-02-11T15:35:10Z")

</div>

On 2/11/08, Xavier N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> On Feb 11, 2008, at 12:40 , Nuwan Chaturanga wrote:
> 
> > Can anyone tell me how to turn on mass assignment in rails 2.0. I am  
> > facing a problem accessing a value of an attr\_protected value sat by a  
> > plugin I am using. I need this value to be assigned to a modle object  
> > but it is silently discarded. Please help.
> 
> Protected attributes are ignored in mass-assignment, that’s the whole  
> point of attr\_protected!

Correct! The OP should think about WHY the plugin is protecting the  
attribute from mass assignment.

The reason this gets done in general is for security, to keep a  
bad-guy user from changing things that shouldn’t be (passwords?  
permissions? …) by forging uri’s with say, additionally query  
parameters in the URI.

–  
Rick DeNatale

My blog on Ruby  
[http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/)

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 12, 2008, 4:43am UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/5 "2008-02-12T04:43:04Z")

</div>

Rick,

The real problem I am facing here is the plugin I use  
(acts\_as\_better\_nested\_set) declares the column “parent\_id” as  
attr\_protected which I need in a controller to reffer to the parent  
object of the cutrrent node (I doubt this plugin was written prior to  
Rails 2.0). I send parent\_id as a hidden field value from view to the  
controller where its get discarded. (I am creating a category tree  
here)

in categories\_controller

def create  
@category = Category.new(params[:category])  
pid = params[:category][:parent\_id]  
if(!@pid.blank?)  
parent = Category.find\_by\_parent\_id(@pid)  
parent.add\_child(@category) #error here  
end  
#other stuff  
end

parent.add\_child(@category) is the code where the error is thrown. It  
says “a category can not be found without an Id”.

do you have any ideas?

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 12, 2008, 12:34pm UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/6 "2008-02-12T12:34:26Z")

</div>

Thanks a lot. I followed the plugin API and it worked.

---

<div class="post-metadata">

**Author:** ![Nuwan\_Chaturanga](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/9de0a6/32.png) [@Nuwan\_Chaturanga](https://www.ruby-forum.com/u/Nuwan_Chaturanga)\
**Post date:** [February 12, 2008, 11:47am UTC](https://www.ruby-forum.com/t/rails-2-0-turn-on-mass-assignment/128768/7 "2008-02-12T11:47:01Z")

</div>

On Feb 12, 2008, at 4:42 , Nuwan Chaturanga wrote:

> The real problem I am facing here is the plugin I use  
> (acts\_as\_better\_nested\_set) declares the column “parent\_id” as  
> attr\_protected which I need in a controller to reffer to the parent  
> object of the cutrrent node (I doubt this plugin was written prior to  
> Rails 2.0).

You need to trust the plugin as a working assumption and tune your  
expectations. If the attribute is protected there may be a good  
reason, in principle a plugin author does not write

```
 attr_protected acts_as_nested_set_options[:left_column].intern,
                 acts_as_nested_set_options[:right_column].intern,
                 acts_as_nested_set_options[:parent_column].intern

```

just arbitrarily. It could happen it is unnecessary, but the best  
hypotheses to work on is it isn’t.

This structure needs some housekeeping for the right/left/parent  
columns and I bet the library user is not supposed to deal with  
parent\_id directly, I guess you must go always through the API to  
establish relationships.

– fxn