Add user_id in multipart file upload array - ruby-on-rails

Question

Using Rails 3.2 and Paperclip to upload multiple files (photos) at once using HTML5 multipart. Here is my form:
# shops/_form.html.erb
<%= form_for #shop, :url => { :action => action, :type => type }, :html => { :multipart => true } do |f| %>
<%= f.text_field :name %>
<%= f.file_field :shop_photos_data, :multiple => true, :name => "shop[photos_attributes][][data]" %>
<% end %>
It works and yields the following result when updated/created:
{"utf8"=>"✓",
"authenticity_token"=>"9jXvIwcllct7UyUfo6cvhEucQf2u3SY50SuaCLtFO4c=",
"shop"=>{
"name"=>"First shop",
"photos_attributes"=>{"0"=>{
"image"=>[
#<ActionDispatch::Http::UploadedFile:0x00000104b78978
#original_filename="first_test_image.jpg",
#content_type="image/jpeg",
#headers="Content-Disposition: form-data; name=\"gallery[photos_attributes][0][image][]\"; filename=\"first_test_image.jpg\"\r\nContent-Type: image/jpeg\r\n",
#tempfile=#<File:/var/folders/bQ/bQYZC2ukFZCvbKzEDGRtJE+++TI/-Tmp-/RackMultipart20110622-4459-vz78ee>>,
#<ActionDispatch::Http::UploadedFile:0x00000104b78950
#original_filename="second_test_image.jpg",
#content_type="image/jpeg",
#headers="Content-Disposition: form-data; name=\"gallery[photos_attributes][0][image][]\"; filename=\"second_test_image.jpg\"\r\nContent-Type: image/jpeg\r\n",
#tempfile=#<File:/var/folders/bQ/bQYZC2ukFZCvbKzEDGRtJE+++TI/-Tmp-/RackMultipart20110622-4459-1jzhhyg>>
]
}
}
}, "commit"=>"Save", "action"=>"create", "controller"=>"shops"}
It works, and it goes to the shops_controller.rb, but doesn't go into photos_controller.rb.
Here are my other parts of the code:
# photo.rb
class Photo < ActiveRecord::Base
belongs_to :attachable, :polymorphic => true, :counter_cache => true
belongs_to :user, :counter_cache => true
attr_accessible :data, :attachable_id, :attachable_type, :user_id
end
# shop.rb
class Shop < ActiveRecord::Base
attr_protected :photos_count
has_many :photos, :as => :attachable, :dependent => :destroy
accepts_nested_attributes_for :photos, :allow_destroy => true
end
# photos_controller.rb
class PhotosController < ApplicationController
end
# shops_controller.rb
class ShopsController < ApplicationController
before_filter :require_user, :only => [:new, :edit, :update, :create]
...
def update
#shop = Shop.find(params[:id])
if #shop.update_attributes(params[:shop])
flash[:notice] = 'Successfully updated.'
redirect_to shop_path(#shop)
else
render :action => :edit
end
end
end
I have a user_id field in my Photo model. Currently, the user_id is not saved in each new Photo record. What can I do in the shops_controller.rb to include the user_id in the file upload array? I don't want to do it in the form because it exposes security.
Thanks.

Answer 1

Put this in shops_controller.rb
def update
#shop = Shop.find(params[:id])
photos = params[:shop][:photos_attributes]
if !photos.blank?
photos.each do |photo|
photo.merge!(:user_id => current_user.id)
end
end
if #shop.update_attributes(params[:shop])
flash[:notice] = 'Successfully updated.'
redirect_to shop_path(#shop)
else
render :action => :edit
end
end

Answer 2

To add the field to the form use a hidden field like this:
<%= hidden_field_tag "user", #user.id %>
Then in the controller you can access it like this:
params[:user]