Ruby on Rails – Treebook. attr_accessible and Rails4

I found out the hard way--omitting the attr_accessible does terrible things to your application. In Rails 4, they moved the permissions from the models, where Treehouse edits them, to the controllers, where they make more sense. So in Rails 4, it seems like all attributes are whitelisted, and strong_parameters would control those their flow.

But I also went through the pain of strong_parameters, which breaks later lessons. Fortunately, Devise has a way to avoid these errors using their parameter sanitizer. You can read about it on the Devise documentation at https://github.com/plataformatec/devise. But here's what it looked like in action for me:

class ApplicationController < ActionController::Base
    before_filter :configure_permitted_parameters, if: :devise_controller?
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_up) << [:email, :password, :password_confirmation, :remember_me, :first_name, :last_name, :profile_name]
  end

end

Later in the lessons, you may also have some trouble with the status update parameter permissions, like I did. By default, the form accepts :name, but we name the parameter :user_id. My code at the end of the statuses controller looks like this:

    def status_params
      params.require(:status).permit(:user_id, :content)
    end

I hope this helps!