Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

accepts_nested_attributes_for

#6314

There is a bug introduced from Rails 3.0.0 -> 3.0.1

It changes the way new models are saved when their class has "accepts_nested_attributes_for" set and one of the associations is not a new record.

ActiveRecord::RecordNotFound: Couldn't find Account with ID=1 for Customer with ID=
/...../activerecord-3.0.1/lib/active_record/nested_attributes.rb:413:in raise_nested_attributes_record_not_found'

Here is a github project, that has the error.

https://github.com/23inhouse/accepts_nested_attributes_test.git
git://github.com/23inhouse/accepts_nested_attributes_test.git

You can clone the project.

bundle install
rake db:migrate
rake test:functional

then edit the Gemfile and change:

gem 'rails', '3.0.1' # fails

to this

gem 'rails', '3.0.0' # passes

bundle update
rake test:functional

Reported by 23inhouse · January 19th, 2011 @ 02:53 AM

State: invalid
Milestone: none
Assigned to: nobody
Importance: Low

Activity

  1. 23inhouse
    23inhouse

    There is a typo please use:

    rake test:functionals

    January 19th, 2011 @ 03:00 AM

  2. Santiago Pastorino
    Santiago Pastorino
    • Importance changed from to Low

    Have you tried tests in 3.0.3? even better what's about 3.0.4.rc1?.
    Thanks.

    January 31st, 2011 @ 09:17 PM

  3. 23inhouse
    23inhouse

    I should have mentioned that it doesn't work in any version after 3.0.0. I was trying to isolate the change that broke it.

    I just ran it in 3.0.4.rc1 and it still fails to pass the test.

    P.S. I'm using ruby-1.9.2-p0

    January 31st, 2011 @ 09:39 PM

  4. Santiago Pastorino
    Santiago Pastorino

    Hey sorry I hadn't check the issue deeply in my first glance.
    The issue you're pointing, is not a real one :), is a security fix.

    February 1st, 2011 @ 02:45 AM

  5. Michael Koziarski
    Michael Koziarski
    • State changed from new to invalid

    Your application was relying on a security vulnerability that was fixed in 3.0.1

    http://groups.google.com/group/rubyonrails-security/t/f9f913d328dafe0c

    If we let you specify the ID like that you could edit arbitrary records in the database by simply changing a few form parameters. This will never be fixed.

    February 1st, 2011 @ 02:45 AM

  6. 23inhouse
    23inhouse

    Michael and Santiago

    Thank you for clarifying that. I was really enjoying just jamming the params into the Models attributes= methods and having it all work, but i can see the problem this causes.

    Thanks again.
    Ben

    February 6th, 2011 @ 03:12 AM

  7. af001
    af001

    私の中で、総合評価のとっても低いアバアバクロホリスタークロ銀座店。アバクロは大好きなんですけどね。一昨日の東京駅付近での打ち合わせの後、散歩がてら久々に行ってきました。そしたらビックリ！相変わらアバクロず、踊っているだけの店員さんとかもいましたが、

    May 5th, 2011 @ 03:00 AM