Rails Error: Can't mass-assign protected attributes: interest_ids?

Question

Im working with a multistep form (using Wicked gem). In the first couple steps of the form i am editing the user model and those steps work fine.. Then I attempt the "interests" model which has a HABTM relationship with the user model. However i get this error:

ActiveModel::MassAssignmentSecurity::Error in UserStepsController#update

Can't mass-assign protected attributes: interest_ids
Rails.root: /Users/nelsonkeating/rails_projects/Oreminder1

Application Trace | Framework Trace | Full Trace
app/controllers/user_steps_controller.rb:12:in `update'

user_steps_controller.rb

 class UserStepsController < ApplicationController
  include Wicked::Wizard
  steps :standard, :personal, :interests, :dates 

 def show
   @user = current_user
   render_wizard
 end

 def update
  @user = current_user
  @user.attributes = params[:user]
 render_wizard @user
end

end

Heres the view:

<%= render layout: 'form' do |f| %>

<% for interest in Interest.find(:all) %>
 <label class="checkbox">
  <%= check_box_tag "user[interest_ids][]", interest.id, @user.interests.include?(interest) %>
  <%= interest.name %>
 </label>
<% end %>

<% end %>

Any ideas? Thanks!

Answer 1

You can get rid of this error by adding this to your user model:

attr_accessible :interest_ids

Without this the interest_ids attribute is protected against mass assignment and when you try to assign values to it anyway an exception is thrown.