Strong Attributes exception in rails 3. No idea whats causing it - ruby-on-rails

Question

Been stuck on this for a few days now. Any help would be much appreciated. I have a form that sends an artist name to a create controller. The create controller creates the artist with the name, assigns a user to that artist, and creates an artist layout. I think i have added the correct whitelisting for the strong params gem, however i get the the below error.
Error:
ActiveModel::ForbiddenAttributes in ArtistsController#create
ActiveModel::ForbiddenAttributes
Rails.root: /sites/music3
Application Trace | Framework Trace | Full Trace
Request
Parameters:
{"utf8"=>"✓",
"authenticity_token"=>"xxxxxxxxxxxxxxxxxxxxxx",
"artist"=>{"name"=>"kkkk"},
"commit"=>"Create Artist"}
Show session dump
Show env dump
Response
Headers:
Controller
def create
#artist = Artist.new(artist_create_params)
#assigns User
#user = current_user
#artist.users << #user
#form = render_to_string('artists/_form',:layout => false)
#creates and assigns layout
#artist.profile_layout = ProfileLayout.new
respond_to do |format|
if #artist.update_attributes(artist_create_params)
format.html { redirect_to(edit_artist_path(#artist.url_slug)) }
format.xml { render :xml => #artist, :status => :created, :location => #artist }
else
format.html { render :action => "new" }
format.xml { render :xml => #artist.errors, :status => :unprocessable_entity }
end
end
end
def artist_create_params
#Using `strong_parameters` gem
params.required(:commit).permit!
params.required(:artist).permit!
end
I'm allowing all params to be past through (params!) as I was trying to identify what was throwing the error. However I would like to whitelist specific params once I figure out what the problem is.
Strong parameters is working in other places. Its just giving me problems on create. Any help would be appreciated
Thanks in advance.
Ted.
Update:
Initializer:
ActiveRecord::Base.send(:include, ActiveModel::ForbiddenAttributesProtection)
Changed to
def artist_create_params
# NOTE: Using `strong_parameters` gem
params.require(:artist).permit(:name)
end
Still getting above error. Doesn't show the line the error is occuring on. See below
Started POST "/artists" for 127.0.0.1 at 2014-06-04 19:10:27 -0400
Processing by ArtistsController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"xxxxxxxxxxxxx", "artist"=>{"name"=>"ffasdf"}, "commit"=>"Create Artist"}
Completed 500 Internal Server Error in 8ms
ActiveModel::ForbiddenAttributes (ActiveModel::ForbiddenAttributes):
strong_parameters (0.2.3) lib/active_model/forbidden_attributes_protection.rb:11:in `sanitize_for_mass_assignment'
activerecord (3.2.11) lib/active_record/attribute_assignment.rb:75:in `assign_attributes'
activerecord (3.2.11) lib/active_record/base.rb:497:in `initialize'
cancan (1.6.8) lib/cancan/controller_resource.rb:85:in `new'
cancan (1.6.8) lib/cancan/controller_resource.rb:85:in `build_resource'
cancan (1.6.8) lib/cancan/controller_resource.rb:66:in `load_resource_instance'
cancan (1.6.8) lib/cancan/controller_resource.rb:32:in `load_resource'
cancan (1.6.8) lib/cancan/controller_resource.rb:25:in `load_and_authorize_resource'
cancan (1.6.8) lib/cancan/controller_resource.rb:10:in `block in add_before_filter'
activesupport (3.2.11) lib/active_support/callbacks.rb:440:in `_run__3264816457187544022__process_action__2854128236876807797__callbacks'
activesupport (3.2.11) lib/active_support/callbacks.rb:405:in `__run_callback'
activesupport (3.2.11) lib/active_support/callbacks.rb:385:in `_run_process_action_callbacks'
activesupport (3.2.11) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (3.2.11) lib/abstract_controller/callbacks.rb:17:in `process_action'
actionpack (3.2.11) lib/action_controller/metal/rescue.rb:29:in `process_action'
actionpack (3.2.11) lib/action_controller/metal/instrumentation.rb:30:in `block in process_action'
activesupport (3.2.11) lib/active_support/notifications.rb:123:in `block in instrument'
activesupport (3.2.11) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
activesupport (3.2.11) lib/active_support/notifications.rb:123:in `instrument'
actionpack (3.2.11) lib/action_controller/metal/instrumentation.rb:29:in `process_action'
actionpack (3.2.11) lib/action_controller/metal/params_wrapper.rb:207:in `process_action'
activerecord (3.2.11) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
actionpack (3.2.11) lib/abstract_controller/base.rb:121:in `process'
actionpack (3.2.11) lib/abstract_controller/rendering.rb:45:in `process'
actionpack (3.2.11) lib/action_controller/metal.rb:203:in `dispatch'
actionpack (3.2.11) lib/action_controller/metal/rack_delegation.rb:14:in `dispatch'
actionpack (3.2.11) lib/action_controller/metal.rb:246:in `block in action'
actionpack (3.2.11) lib/action_dispatch/routing/route_set.rb:73:in `call'
actionpack (3.2.11) lib/action_dispatch/routing/route_set.rb:73:in `dispatch'
actionpack (3.2.11) lib/action_dispatch/routing/route_set.rb:36:in `call'
journey (1.0.4) lib/journey/router.rb:68:in `block in call'
journey (1.0.4) lib/journey/router.rb:56:in `each'
journey (1.0.4) lib/journey/router.rb:56:in `call'
actionpack (3.2.11) lib/action_dispatch/routing/route_set.rb:601:in `call'
warden (1.2.1) lib/warden/manager.rb:35:in `block in call'
warden (1.2.1) lib/warden/manager.rb:34:in `catch'
warden (1.2.1) lib/warden/manager.rb:34:in `call'
client_side_validations (3.2.5) lib/client_side_validations/middleware.rb:21:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/best_standards_support.rb:17:in `call'
rack (1.4.3) lib/rack/etag.rb:23:in `call'
rack (1.4.3) lib/rack/conditionalget.rb:35:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/head.rb:14:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/params_parser.rb:21:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/flash.rb:242:in `call'
rack (1.4.3) lib/rack/session/abstract/id.rb:210:in `context'
rack (1.4.3) lib/rack/session/abstract/id.rb:205:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/cookies.rb:341:in `call'
activerecord (3.2.11) lib/active_record/query_cache.rb:64:in `call'
activerecord (3.2.11) lib/active_record/connection_adapters/abstract/connection_pool.rb:479:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/callbacks.rb:28:in `block in call'
activesupport (3.2.11) lib/active_support/callbacks.rb:405:in `_run__1232201288606729007__call__1474813276301895872__callbacks'
activesupport (3.2.11) lib/active_support/callbacks.rb:405:in `__run_callback'
activesupport (3.2.11) lib/active_support/callbacks.rb:385:in `_run_call_callbacks'
activesupport (3.2.11) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (3.2.11) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/reloader.rb:65:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/remote_ip.rb:31:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/debug_exceptions.rb:16:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/show_exceptions.rb:56:in `call'
railties (3.2.11) lib/rails/rack/logger.rb:32:in `call_app'
railties (3.2.11) lib/rails/rack/logger.rb:18:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/request_id.rb:22:in `call'
rack (1.4.3) lib/rack/methodoverride.rb:21:in `call'
rack (1.4.3) lib/rack/runtime.rb:17:in `call'
activesupport (3.2.11) lib/active_support/cache/strategy/local_cache.rb:72:in `call'
rack (1.4.3) lib/rack/lock.rb:15:in `call'
actionpack (3.2.11) lib/action_dispatch/middleware/static.rb:62:in `call'
railties (3.2.11) lib/rails/engine.rb:479:in `call'
railties (3.2.11) lib/rails/application.rb:223:in `call'
rack (1.4.3) lib/rack/content_length.rb:14:in `call'
railties (3.2.11) lib/rails/rack/log_tailer.rb:17:in `call'
rack (1.4.3) lib/rack/handler/webrick.rb:59:in `service'
/Users/therealtedkennedy/.rvm/rubies/ruby-1.9.2-p320/lib/ruby/1.9.1/webrick/httpserver.rb:111:in `service'
/Users/therealtedkennedy/.rvm/rubies/ruby-1.9.2-p320/lib/ruby/1.9.1/webrick/httpserver.rb:70:in `run'
/Users/therealtedkennedy/.rvm/rubies/ruby-1.9.2-p320/lib/ruby/1.9.1/webrick/server.rb:183:in `block in start_thread'

Answer 1

Based on the stack trace, it looks like the assignment that triggers the error is coming from cancan, not from setting the artist's name. Try temporarily disabling the before_filter that uses cancan and see whether that resolves the issue. If it does, then you need to re-enable it, dig into cancan and figure out how to make it play nicely with strong_parameters. I don't use it myself, but I think there's a fork for Rails 4 called cancancan, which might work with rails 3.2 and strong_parameters as well.
Unrelated to your immediate problem, but you should probably also look at upgrading to the latest version in the Rails 3.2.x series to pick up the different security fixes they've released.

Answer 2

You don't need to permit the :commit params because you aren't trying to mass assign them to anything. Just use:
params.require(:artist).permit!
Or even better:
params.require(:artist).permit(:name)
That said, I'm surprised you're getting the error you say, so fix that and report back.

Answer 3

Skipping the cancan authorization defeats the purpose of having cancan.
This is what I did:
Switch to CanCanCan
As per the CanCanCan docs:
This repo is a continuation of the dead CanCan project. Our mission is to keep CanCan alive and moving forward, with maintenance fixes and new features.
CanCanCan also supports Strong Parameters out of the box.
Create Private Methods for create_params or update_params
As per docs, create private methods in your controllers to handle attribute permissions:
private
def create_params
params.require(:speaking_lesson).permit(:name, :description, exercises_attributes: [:text])
end
And then you'll have access an instance of the new model for use, in your create method:
def create
# #speaking_lesson is automatically created by CanCanCan during load_and_authorize_resource
#speaking_lesson.user_id = current_user.id
... do other stuff ...
end