diff --git a/app/models/spree/wished_product.rb b/app/models/spree/wished_product.rb
index c0f12b9f..552927dd 100644
--- a/app/models/spree/wished_product.rb
+++ b/app/models/spree/wished_product.rb
@@ -2,5 +2,5 @@ class Spree::WishedProduct < ActiveRecord::Base
   belongs_to :variant
   belongs_to :wishlist
   
-  attr_accessible :wishlist_id, :variant_id
+  attr_accessible :wishlist_id, :variant
 end
diff --git a/app/models/spree/wishlist.rb b/app/models/spree/wishlist.rb
index b1db66fe..99ca5855 100644
--- a/app/models/spree/wishlist.rb
+++ b/app/models/spree/wishlist.rb
@@ -3,7 +3,7 @@ class Spree::Wishlist < ActiveRecord::Base
   has_many :wished_products
   before_create :set_access_hash
 
-  attr_accessible :name, :is_default, :is_private
+  attr_accessible :name, :is_default, :is_private, :user
     
   validates :name, :presence => true
 
diff --git a/spec/models/spree/wishlist_spec.rb b/spec/models/spree/wishlist_spec.rb
index 639c3a0a..edd96179 100644
--- a/spec/models/spree/wishlist_spec.rb
+++ b/spec/models/spree/wishlist_spec.rb
@@ -6,6 +6,14 @@
     @wishlist = Spree::Wishlist.new(:user => @user, :name => "My Wishlist")
   end
 
+  context "can't mass assign ids" do
+    it "should not be able to assign variant_id" do
+      lambda {
+        Spree::Wishlist.new(:user_id => @user.id, :name => "My Wishlist")  
+      }.should raise_error
+    end
+  end
+  
   context "creating a new wishlist" do
     it "is valid with valid attributes" do
       @wishlist.should be_valid
@@ -29,7 +37,7 @@
       @wishlist.include?(@variant.id).should be_true
     end
   end
-
+  
   context "#to_param" do
     it "should return the wishlist's access_hash" do
       @wishlist.to_param.should == @wishlist.access_hash