Any word on Rails 4 / Strong Parameters?

[coreyward]

There appears to be an omission of integrating with Rails 4 — what parameters need to be permitted for Attachinary to work correctly?

[mklb]

If your Model has for example:

has_attachment :cover_image, accept: [:jpg,:jpeg, :png, :gif]
has_attachments :images, accept: [:jpg,:jpeg, :png, :gif]

You need to permit images like:
params.require(:YOUR_MODEL_NAME).permit(:cover_image, images: [])

[coreyward]

This actually didn't work for me — I was still getting errors about unpermitted parameters. I actually resorted to this hack to get things working:

module Attachinary
  module Utils
    # Don't raise errors on the presence of the following attributes in params:
    #   :signature, :created_at, :bytes, :type, :etag, :url, :secure_url, :tags, :pages
    def self.process_hash(hash, scope=nil)
      if hash['id']
        Attachinary::File.find hash['id']
      else
        file = if Rails::VERSION::MAJOR == 3
          Attachinary::File.new hash.slice(*Attachinary::File.attr_accessible[:default].to_a)
        else
          # this line added:
          hash.except!("signature", "created_at", "bytes", "type", "etag", "url", "secure_url", "tags", "pages")
          permitted_params = ActionController::Parameters.new(hash).permit(:public_id, :version, :width, :height, :format, :resource_type)
          Attachinary::File.new(permitted_params)
        end
        file.scope = scope.to_s if scope && file.respond_to?(:scope=)
        file
      end
    end
  end
end

[mklb]

this is very strange.. it should work like this:

If your model blog_post.rb has
has_attachment :cover_image, accept: [:jpg,:jpeg, :png, :gif]
has_attachments :images, accept: [:jpg,:jpeg, :png, :gif]

You need to permit the images and cover_images inside the blog_post_controller.rb like:
params.require(:blog_post).permit(:cover_image, images: [])

[dannyvanhoof]

I have exactly the same problem. Debugged this, and params like "bytes", "type", etc. go straight into the process_hash method, where they are logged, unless you have action_on_unpermitted_parameters on :raise, in which case you get an error, exactly as coreyward describes. Will this be addressed?

[dannyvanhoof]

This is exactly what I do, but the additional fields end up in the process_hash method anyway, where they raise an error, as that is what I’ve set to do when there are unpermitted parameters. The monkey patch, as described by coreyward solves the issue.

Van: Anton [mailto:notifications@github.com]
Verzonden: woensdag 20 augustus 2014 23:37
Aan: assembler/attachinary
CC: dannyvanhoof
Onderwerp: Re: [attachinary] Any word on Rails 4 / Strong Parameters? (#88)

params.require(:YOUR_MODEL_NAME).permit(:cover_image, {images: []})

—
Reply to this email directly or view it on GitHub #88 (comment) .

[milesmatthias]

Is there a reason @spitzer's batch hasn't been merged in?

[fabianoleittes]

Hi guys!!
Any solution to the problem of Strong Parameters(mass-assign protected attributes) ?

I'm using rails version 4.2.3

found unpermitted parameters: signature, created_at, tags, bytes, type, etag, url, secure_url, original_filename

[coreyward]

Hey @fabianoleittes,

The easiest way (barring @assembler merging @spitzer's pull request), is to update your Gemfile to use the following:

gem 'attachinary', github: 'spitzer/attachinary', ref: 'd65f15e26844c4253e8359d5c2b750a50f52afbd'

After changing, be sure to run bundle update and restart your app and you should be smooth sailing.

If you're not fond of referencing a Github-hosted repo that could disappear at any time, you have a couple options:

1. Fork spitzer/attachinary and reference your own copy of the repo.
2. Monkey patch the library (as I did, referenced above).

Good luck!

[tocker]

Hi All,

Thanks for reporting, tracking and contributing information on this issue.
I've update the code with a solution.
Can you get the code latest from master and retest?

Thanks!

[stebo]

Works with the current version so just including gem 'attachinary' is fine.
But you should definitely add this to the readme and explain users, that they have to adjust their def xyz_params function according to has_attachments... took me a lot of time to figure out why no entry was saved into my attachinary_files table!

[coreyward]

@stebo That's the problem that's fixed in master. You shouldn't have to adjust your permitted params.