Rails - MassAssignmentSecurity:: Error on multiple photo upload - ruby-on-rails

Question

I want to make a product page for a small app. This product page should allow the user to add multiple photos. So naturally there are three models. User, Product and Photo. User has_many products and products has_many photos.
All was dandy but whenever I try to add a number of photos I get this error.
ActiveModel::MassAssignmentSecurity::Error in ProductsController#create
Can't mass-assign protected attributes: photos_attributes
products controller
def new
#product = Product.new
#photo = Photo.new
4.times{ #product.photos.build }
end
def create
#product = current_user.products.new(params[:product])
#photo = current_user.photos.new(params[:photo])
if #product.valid? && #photo.valid?
#product.save
#photo.product_id = #product.id
#photo.save
render "show", :notice => "Sale created!"
else
render "new", :notice => "Somehting went wrong!"
end
end
new product page(HAML)
= form_for #product,:url => products_path, :html => { :multipart => true } do |f|
- if #product.errors.any?
.error_messages
%h2 Form is invalid
%ul
- for message in #product.errors.full_messages
%li
= message
- if #photo.errors.any?
.error_messages
%h2 Image is invalid
%ul
- for message in #photo.errors.full_messages
%li
= message
%p
= f.label :name
= f.text_field :name
%p
= f.label :description
= f.text_field :description
%p
= f.fields_for :photos do |fp|
=fp.file_field :image
%br
%p.button
= f.submit
Product Model
class Product < ActiveRecord::Base
attr_accessible :description, :name, :price, :condition, :ship_method, :ship_price, :quantity, :photo
has_many :photos, dependent: :destroy
accepts_nested_attributes_for :photos
belongs_to :user
end
Photo model
class Photo < ActiveRecord::Base
attr_accessible :image
belongs_to :product
has_attached_file :image, styles: { medium: "320x240>", :thumb => "100x100>"}
end
schema.rb
create_table "photos", :force => true do |t|
t.integer "product_id"
t.datetime "created_at", :null => false
t.datetime "updated_at", :null => false
t.string "image_file_name"
t.string "image_content_type"
t.integer "image_file_size"
end
create_table "products", :force => true do |t|
t.string "name"
t.text "description"
t.datetime "created_at", :null => false
t.datetime "updated_at", :null => false
t.integer "user_id"
end
Edit: when i add :photos_attributes to product model attr_accessible i get an error that says Image can't be blank !!

Answer 1

Just add photos_attributes to the attr_accessible list in the Product model. Or even better, try to migrate to strong_parameters gem, will save you sometime when you migrate to Rails 4.
Update
In create action, you create a #photo variable from params[:photo], which is knows to return nil, yielding the object invalid always. That said, you don't need to create that variable as Photo objects are already made for as you use accepts_nested_attributes_for already. I understand that you need to know if the Photos are created successfully, but you shouldn't be worrying about it as errors from product's new photos will propagate to the product, stopping the saving process.