Rails 3 Mass Assignment Errors with For_fields

Question

I have the following model relationships:
OrderModel:

has_one :credit_card accepts_nested_attributes_for :credit_card attr_accessible :user_id, :date_updated, :date_finished, :amount, :payment_method, :status, :billing_cycle, :auth_net_subscription_id, :billing_start_date, :credit_card_attributes, :billing_address_id, :cc_id 

CreditCardModel:

 belongs_to :order 

Here is my order controller (orders # checkout)

 def checkout @order = current_order @cc = CreditCard.new @order.build_credit_card respond_with @order end 

Here is the form to enter in the CC order:

 <%= form_for(@order, :url => finish_checkout_path, :html => { :class => 'validate' }) do |f| %> <%= f.fields_for @cc do |cc| %> <%= cc.text_field :cc_number, :placeholder => "Credit Card Number", :class => "full-width validate[required, creditCard] cc" %> <%= cc.text_field :name, :placeholder => "Name as it appears on card", :class => "full-width validate[required]" %> <%= select_month(Date.today, {:field_name => 'exp_month', :prefix => "order[credit_card]", :prompt => "EXP. MONTH"}, { :class => "dk half-width validate[required,past] marginRight10" }) %> <%= select_year(Date.today, {:field_name => 'exp_year', :prefix => "order[credit_card]", :prompt => "EXP. YEAR", :start_year => Date.today.year, :end_year => Date.today.year + 10}, { :class => "dk half-width validate[required]" }) %> <%= link_to "What this?", "#", :class => 'cvv-help' %> <%= cc.text_field :cvv, :class => 'half-width validate[required] marginRight10', :placeholder => "CVV" %> <%= cc.text_field :zip_code, :class => 'half-width validate[required]', :placeholder => "Zip Code" %> <% end %> <%= f.hidden_field :amount, :value => @order.products.collect(&:price).reduce(&:+) %> <p class="tos">By clicking the button below you agree to our <a href="#" class="pink">terms of service</a>.</p> <p class="align-center"><%= f.submit "Submit", :class => 'btn submit' %></p> <% end %> 

And this is where I update the order (order # ends):

 current_order.update_attributes(params[:order]) 

When I do this, I get the following error: Can't mass-assign protected attributes: credit_card

I explicitly have credit_card_attributes attributes in my attr_accessible , so I'm not sure why this is an error.

Answer 1

Not sure, but it could be due to your controller code:

 def checkout @order = current_order @cc = CreditCard.new @order.build_credit_card respond_with @order end 

At the same time, the credit card that you use in your fields_for is not associated with your order. This can be a problem.

Try to do this:

 def checkout @order = current_order @order.build_credit_card respond_with @order end 

and

 <%= f.fields_for :credit_card do |cc| %>