Custom engine generator should create attributes whitelist now that rails requires you to do so

[murdoch]

Rails 3.2.3 expects you to white-list your model's attributes before you can write to the db.

If you create a custom engine using rails g refinery:engine article attr1 attr2 attr3, then you will not be able save any records until you set attr_accessible in your model. Rails throws a mass-assignment error until you do. You will also need to include the refinery-generated position field in your whitelist.

[parndt]

hm this was done already https://github.com/resolve/refinerycms/blob/2-0-stable/core/lib/generators/refinery/engine/templates/app/models/refinery/namespace/singular_name.rb#L8

Can you try putting in your Gemfile:

gem 'refinerycms', :git => 'git://github.com/resolve/refinerycms.git', :branch => '2-0-stable'

bundle and generate the engine again.. does it still need attr_accessible?

[murdoch]

It 'almost' fixes the problem. I ran the following code:

rails g refinery:engine facility name:string machine:integer city:string description:text tldr:text

And here is what refinery generated for me:

attr_accessible :name, :position
acts_as_indexed :fields => [:name, :city, :description, :tldr]

As you can see, attr_accessible is set, but only for the first attribute (and position), so I still get the mass assignment error.

[ugisozols]

Imo user should take care of specifying which attributes he want's to allow to be mass-assigned. Refinery should not guess those attributes. For example what happens when I generate an engine with admin boolean attribute which I clearly don't want to be mass-assigned? I would have to go into model and delete it from attr_accessible ...

[parndt]

We should have best practice by default. Plus, this code's already in our codebase..

[ugisozols]

@parndt what's best practice?

[parndt]

To make it work out of the box

[ugisozols]

@parndt ^