ActiveModel Forbidden Error in Rails 4.0.0 - ruby-on-rails

Question

Im working on a nested attribute form.
these are the two models..
Employee.rb
class Employee < ActiveRecord::Base
has_one :employee_info, :primary_key => :employeeID, foreign_key: :employeeID
accepts_nested_attributes_for :employee_info
end
EmployeeInfo.rb
class EmployeeInfo < ActiveRecord::Base
belongs_to :employee, primary_key: :employeeID, foreign_key: :employeeID
validates_uniqueness_of :employeeID
end
And i have my form in _form.html.rb
<%= form_for #employee, html: {class: "form form-horizontal validate-form", novalidate: "novalidate"} do |f| %>
<% if #employee.errors.any? %>
<div id="error_explanation">
<div class="alert alert-danger alert-dismissable">
<a class="close" data-dismiss="alert" href="#">×</a>
<h2><%= pluralize(#employee.errors.count, "error") %> prohibited this shop from being saved:</h2>
<ul>
<% #employee.errors.full_messages.each do |msg| %>
<li><%= msg %></li>
<% end %>
</ul>
</div>
</div>
<% end %>
<div class='form-group'>
<%= f.label :employeeID, class: 'col-md-2 control-label' %>
<div class='col-md-5'>
<%= f.text_field :employeeID, {class: 'form-control'} %>
</div>
</div>
<div class='form-group'>
<%= f.label :employee_name, class: 'col-md-2 control-label' %>
<div class='col-md-5'>
<%= f.text_field :employee_name, class: 'form-control' %>
</div>
</div>
<%= f.fields_for :employee_info do |ff| %>
<div class='form-group'>
<%= ff.label :hired, class: 'col-md-2 control-label' %>
<div class='col-md-5'>
<%= ff.text_field :hire_date, class: 'form-control' %>
</div>
</div>
<div class='form-group'>
<%= ff.label :terminated, class: 'col-md-2 control-label' %>
<div class='col-md-5'>
<%= ff.text_field :term_date, class: 'form-control' %>
</div>
</div>
<% end %>
<div class='form-actions form-actions-padding-sm'>
<div class='row'>
<div class='col-md-10 col-md-offset-2'><i class='icon-save custom-icon'></i>
<% if params[:action] == "new" %>
<%= f.submit "Create", class: 'btn btn-primary custom-button' %>
<% else %>
<%= f.submit "Update", class: 'btn btn-primary custom-button' %>
<% end %>
<%= link_to 'Cancel', shops_path, class: 'btn' %>
</div>
</div>
</div>
<% end %>
and the update method in controller
def update
respond_to do |format|
p "------------------------------"
p employee_params
if #employee.update(employee_params)
format.html { redirect_to #employee, notice: 'Employee was successfully updated.' }
format.json { head :no_content }
else
format.html { render action: 'edit' }
format.json { render json: #employee.errors, status: :unprocessable_entity }
end
end
end
where that p employee_params output in console is
{"employeeID"=>"103", "employee_name"=>"James Michule", "employee_info_attributes"=>{"hire_date"=>"1996-03-12 11:30:00 UTC", "term_date"=>"1996-03-12 11:30:00 UTC", "hourly_rate"=>"7.4", "address"=>"108 E. Jay", "phone_number1"=>"", "phone_number2"=>"", "zipcode"=>"65721", "state"=>"MO", "city"=>"Ozark", "id"=>"30"}}
and when i try to update i get an error..
error:
ActiveModel::ForbiddenAttributesError (ActiveModel::ForbiddenAttributesError):
app/controllers/employees_controller.rb:56:in `block in update'
app/controllers/employees_controller.rb:53:in `update'
What is wrong.? Please help

Answer 1

Rails 4 has features from the strong_parameters
so you can use
#employee.update_attributes(params[:employee], permit[:employee_attribute]
or you can do in following way
#employee.update_attributes(params[:employee].permit(:employeeID))

Answer 2

Your employees_controller
private
def employee_params
params.require(:employee).permit(:term_date, :hire_date)
end
Add term_date & hire_date in the employee_params method like the code above.
Hope it solves the issue.
P.S. And please read the topic "Rails Strong parameters" before creating the app on rails >= 4