Topic: ActiveResource Mass Assignment Issue with Timestamp Fields

Hi Everyone,

I'm having an issue trying to use ActiveResource for basic CRUD operations on a basic rails model.  The documentation on ActiveResource pretty much just says to make a subclass of ActiveResource::Base and set self.site.  That works pretty well, until I try to update an existing record that I've retreived.  I'm getting a MassAssignmentSecurity::Error when I call the save() method on my ActiveResource object because the created_at and updated_at fields are not accessible.

Now, I can get around this by marking those fields with attr_accessible on my model class, but that seems like a really poor (and insecure) solution.

Here is an example I built to show the issue:

rails new ARTest
cd ARTest
rails generate scaffold Person first:string last:string
rake db:create
rake db:migrate
rails server

Then in a separate terminal window:

irb
require 'active_resource'
class Person < ActiveResource::Base
self.site = 'http://localhost:3000'
end
x = Person.new()
x.first = 'Bob'
x.last = 'Smith'
x.save() # This works.
y = Person.find(1)
y.first = 'Joe'
y.save() # This does not work.

I haven't been able to find any mention of this issue anywhere.  Is there a "correct" solution for this?

Thanks,
-Adam

Last edited by platta (2012-11-20 13:17:53)

Re: ActiveResource Mass Assignment Issue with Timestamp Fields

I'm guessing you would want to discard the time stamp fields and have rails create them automatically as normal. So I would write a json/xml template for the app that you are getting the data from that doesn not include the time stamp fields.
If you do not have access to the app you are importing data from then you shouid/could "throw away" the time stamp data

What you want and what you need are too often not the same thing!
When your head is hurting from trying to solve a problem, stop standing on it. When you are the right way up you will see the problem differently and you just might find the solution.
(Quote by me 15th July 2009)

Re: ActiveResource Mass Assignment Issue with Timestamp Fields

Hi jamesw,

I do have access to the app providing the data, so I did a little searching on how to write a json template (I'm very new to Ruby and to Rails).  I found this post talking about the as_json method, and I added this code to my rails model to test:

def as_json(options = {})
  super(:except => [:created_at, :updated_at])
end

This worked very nicely, and I can see that the timestamp fields are still being updated by the rails server itself.  It still feels strange that none of this is in the documentation for ActiveResource, but overriding as_json is a pretty clean solution.

Thanks for your help!

-Adam

Re: ActiveResource Mass Assignment Issue with Timestamp Fields

Ryan Bates covers some great templating options for json and xml
It might be worth you taking a look at
jbuilder and RABL both are great options
http://railscasts.com/episodes?utf8=%E2 … earch=json

What you want and what you need are too often not the same thing!
When your head is hurting from trying to solve a problem, stop standing on it. When you are the right way up you will see the problem differently and you just might find the solution.
(Quote by me 15th July 2009)