Passing ID Value to a Controller, Getting Mass Assignment Security Error - ruby-on-rails

Question

I have a message model and a user model. my message belongs_to my user and user has_many messages.
I'm trying to allow a user to private message another user while on their public profile page (their show template). I have tried a number of attempts, but I ultimately run back into the issue of requiring an ID to be attr_accessible (which I heard is bad to do). Am I doing something wrong?
My message model, I have :user_id (which is the current user, aka a sending_from ID), :to_id, :content.
When I'm looking at a users profile page, on the show template I have
<%= form_for([current_user, #message]) do |f| %>
<%= f.hidden_field :to_id, :value => #user.id %>
<div class="field">
<%= f.text_area :content, placeholder: "Send a private message..." %>
</div>
<%= f.submit "Post", class: "btn btn-large btn-primary" %>
<% end %>
In my user show action, I have
def show
#user = User.find(params[:id])
#microposts = #user.microposts.paginate(page: params[:page])
if user_signed_in?
#message = current_user.messages.build(params[:messages], to_id: #user.id)
end
end
when the form submits, it goes to my message create action
def create
#message = current_user.messages.build(params[:message])
redirect_to user_path(params[:message][:to_id])
end
However, I always get the error
`Can't mass-assign protected attributes: to_id`
It seems like I can fix it by making :to_id attr_accessible, however I have heard it is not very safe to do so. Am I doing something wrong? This issue has been killing me.
Any help would be appreciated. Thanks

Answer 1

Making to_id accessible is fine. But if you don't want that error just fix it like this:
def create
#message = current_user.messages.build
#message.to_id = params[:message][:to_id]
# manually assign whatever other params you need to
redirect_to user_path(params[:message][:to_id])
end
Mass assignment just means you can't use update_attributes, you can still use model.attribute=. The reason for doing it that way might be to add additional whitelisting parameters, such as:
def create
safe_params = params[:model].slice(:safe_attr1,:safe_attr2)
#model = Model.new(safe_params)
whitelist = ['some_safe_string','another_safe_string']
if whitelist.include?(params[:model][:dangerous])
#model.dangerous_attribute = params[:model][:dangerous]
end
#model.save
redirect_to #model
end