ruby-on-railsmass-assignment

Rails | Mass assignment is not throwing any error and copying id of models also

Originally, when I tried to do this:

ans = Book.new Book.last.attributes

It used to throw me a warning:

WARNING: Can't mass-assign protected attributes for Book: id

And the new object created without id being copied.

But now when I upgraded from rails 4.2.8 to 4.2.10, and also upgraded my other gems. I don't get any warnings, and the id is also being copied from the attributes. I want to create a new object, with id being nil.

Why would the behaviour of mass assignment security change with gem upgrades? I didn't add any new gem.

Solution

  • I had to remove or downgrade protected-attributes gem to the previous version. We were using it to allow parameters without permitting, but with new version it was letting even id and other protected attributes to copy as well.