Getting a ActiveModel::ForbiddenAttributesError in controller - ruby-on-rails

Question

I'm implementing a search method in a controller, and I keep getting this error:
ActiveModel::ForbiddenAttributesError in TripsController#search
Extracted source (around line #22):
The offending line is within the following block:
if params[:search].present?
#trips = Trip.where("destination LIKE :destination", {:destination=> "%#{params[:search].first}%"}).where(#filters)
else
#trips = (Trip.where(#filters)) rescue (Trip.where(#filters).paginate(:page => params[:page], :per_page => 10))
end
Below is the full method code:
def search
#languages = Trip.pluck(:language).uniq
#interests = Trip.pluck(:interests).uniq
#destinations = Trip.pluck(:destination).uniq
#filters = params.slice(:language,:interests)
#search_param = params[:search].first rescue nil
#language_param = params[:language]
#intersts_param = params[:interests]
if params[:search].present?
#trips = Trip.where("destination LIKE :destination", {:destination=> "%#{params[:search].first}%"}).where(#filters)
else
#trips = (Trip.where(#filters)) rescue (Trip.where(#filters).paginate(:page => params[:page], :per_page => 10))
end
end

Answer 1

You need to use the Rails strong parameters.
Even if you are not using the parameters to to create a model Rails will raise an exception if you use params.slice and pass the result to a query.
This is due of the pretty pro-active approach that came with Rails 4 to avoid mass-assignment vulnerabilities.
def search
#languages = Trip.pluck(:language).uniq
#interests = Trip.pluck(:interests).uniq
#destinations = Trip.pluck(:destination).uniq
#filters = params.permit(:language,:interests)
#search_param = params.permit(search: [])
#language_param = #filters[:language]
#intersts_param = #filters[:interests]
if params[:search].present?
# you don't need named placeholders for a single parameter...
#trips = Trip.where("destination LIKE ?", params[:search].first)
.where(#filters)
else
#trips = (Trip.where(#filters)) rescue (Trip.where(#filters).paginate(:page => params[:page], :per_page => 10))
end
end
However in .where(#filters) you are breaking a cardinal rule and passing user input straight into a SQL query.
Instead you should use something like this:
Trip.where(language: #filters[:language])
This will create a "WHERE trips.language = ?" query with a placeholder which removes the SQL injection vulnerability.