This project is archived and is in readonly mode.
accepts_nested_attributes_for
Reported by 23inhouse | January 19th, 2011 @ 02:53 AM
There is a bug introduced from Rails 3.0.0 -> 3.0.1
It changes the way new models are saved when their class has "accepts_nested_attributes_for" set and one of the associations is not a new record.
ActiveRecord::RecordNotFound: Couldn't find Account with ID=1
for Customer with ID=
/...../activerecord-3.0.1/lib/active_record/nested_attributes.rb:413:in
raise_nested_attributes_record_not_found'
Here is a github project, that has the error.
https://github.com/23inhouse/accepts_nested_attributes_test.git
git://github.com/23inhouse/accepts_nested_attributes_test.git
You can clone the project.
bundle install
rake db:migrate
rake test:functional
then edit the Gemfile and change:
gem 'rails', '3.0.1' # fails
to this
gem 'rails', '3.0.0' # passes
bundle update
rake test:functional
Comments and changes to this ticket
-
-
Santiago Pastorino January 31st, 2011 @ 09:17 PM
- Importance changed from “” to “Low”
Have you tried tests in 3.0.3? even better what's about 3.0.4.rc1?.
Thanks. -
23inhouse January 31st, 2011 @ 09:39 PM
I should have mentioned that it doesn't work in any version after 3.0.0. I was trying to isolate the change that broke it.
I just ran it in 3.0.4.rc1 and it still fails to pass the test.
P.S. I'm using ruby-1.9.2-p0
-
Santiago Pastorino February 1st, 2011 @ 02:45 AM
Hey sorry I hadn't check the issue deeply in my first glance.
The issue you're pointing, is not a real one :), is a security fix. -
Michael Koziarski February 1st, 2011 @ 02:45 AM
- State changed from “new” to “invalid”
Your application was relying on a security vulnerability that was fixed in 3.0.1
http://groups.google.com/group/rubyonrails-security/t/f9f913d328dafe0c
If we let you specify the ID like that you could edit arbitrary records in the database by simply changing a few form parameters. This will never be fixed.
-
23inhouse February 6th, 2011 @ 03:12 AM
Michael and Santiago
Thank you for clarifying that. I was really enjoying just jamming the params into the Models attributes= methods and having it all work, but i can see the problem this causes.
Thanks again.
Ben -
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
Jeremy Kemper
Michael Koziarski
Piotr Sarnacki
Santiago Pastorino