0

I'm using a form to add an post, and I need to send the id of the current user along with the entry parameters. Here is my form code:

<%= form_for [@topic, @post] do |f| %>
  <%= render 'shared/error_messages', object: f.object %>
  <div class="field">
        <%= f.hidden_field :user_id, :value => current_user.id %>
    <%= f.hidden_field :topic_id, :value => topic.id %>
        <%= f.text_area :content, placeholder: "yorumunuzu girin..." %>
  </div>
  <%= f.submit "Gönder", class: "btn btn-large btn-primary" %>
<% end %>

and my posts_controller :

def new
        @topic= Topic.find_by_id(params[:id])
        @post = @topic.posts.build(params[:post])
    end

    def show
    @post= Post.find(params[:id])
    @topic= @post.topic
  end 

    def create
        @topic= Topic.find_by_id(params[:id])
        @post = @topic.posts.build(params[:post])
        if @post.save
            flash[:success] = "Konu oluşturuldu!"
            redirect_to topic_path(topic)
        else
            render 'static_pages/home'
        end
    end

I use partials so i use these code in the topic_controller.rb

  def show      
        @topic = Topic.find(params[:id])
        @posts = @topic.posts.paginate(page: params[:page])
        @post = @topic.posts.build if signed_in?
  end

I nested my resources :

resources :users
resources :sessions, only: [:new, :create, :destroy]

resources :topics , only: [:show, :create, :destroy] do
resources :posts, only: [:create, :show, :new]
end

. when i post a comment, error log is :

{"utf8"=>"✓",
 "authenticity_token"=>"y0wzskqK9LfXSPIYW4EmqRii1Tg7bD1CG0kno+gcagQ=",
 "post"=>{"user_id"=>"1",
 "content"=>"yeni yorum"},
 "commit"=>"Gönder",
 "topic_id"=>"3"}

So It does not post the topic_id. In the topic show page I want to show the topic, the posts belonging to it and a post form. And when a user posts a comment I want it redirect to same page.So my redirect_to topic_path(topic)is correct or wrong?. Thank for reading .

EDIT 1: I tried the below solutions . I changed

<%= f.hidden_field :user_id, :value => current_user.id %>
<%= f.hidden_field :topic_id, :value => @post.topic.id %>

Now the error code changed

 undefined method `posts' for nil:NilClass
{"utf8"=>"✓",
 "authenticity_token"=>"y0wzskqK9LfXSPIYW4EmqRii1Tg7bD1CG0kno+gcagQ=",
 "post"=>{"user_id"=>"1",
 "topic_id"=>"3",
 "content"=>"yorum"},
 "commit"=>"Gönder",
 "topic_id"=>"3"}

I must edit my new action . My mind is stuck but I wont give up.

1
  • i don't understand your problem, but shouldn't it be redirect_to topic_path(@topic) with an @ you know?
    – phoet
    Jun 27, 2012 at 8:36

3 Answers 3

1

Since you have nested routes (posts under topics) and you build your form with <%= form_for [@topic, @post] do |f| ... %> you should have topic_id already accessible from your controller in:

params[:topic_id]

(thanks to the routing)

However you should not directly assign topic_id to post, but instead assign topic instance.

# wrong (security flaw)
@post.topic_id = params[:topic_id]

# correct
@post.topic = Topic.find(params[:topic_id])

That way you can make necessary checks on the topic - make sure that it exists, user is allowed to use it, etc. Otherwise user can easily send you any value he wants.

[edit]

For the same reason you don't want to post user_id in your form, because it can be manually altered by malicious user even if it's hidden field. Instead assign user to post in controller.

@post.user = current_user
3
  • def create @topic= Topic.find_by_id(params[:id]) @post = @topic.posts.build(params[:post]).So how must i rebuild this line is this correct?
    – ytsejam
    Jun 27, 2012 at 10:33
  • You need to find topic by params[:topid_id], not params[:id]. You can also add @post.user = current_user and then @post.save Jun 27, 2012 at 10:36
  • I made it .. this is the posts_controller with correct redirect_to
    – ytsejam
    Jun 27, 2012 at 13:17
0

I would suggest adding an hidden form field wich submits the value's after you submit it make sure you add the hash key values to your update_attribute or create method.

NOTE: with hidden fields you need to set the value by adding the actual value key as in:

f.hidden_field, :topic_id, :value => post.topic.id

then in your update or create function you want to add the submitted param value as in:

n = Comment.new
n.topic_id = params[:form_key][:topic_id].to_i

have fun

4
  • In my new action i use params[:post] .. Shall i seperate it?
    – ytsejam
    Jun 27, 2012 at 8:03
  • You could do that although you need to be aware of a vulrenability called Mass Assignment just make sure protected credentials aren't passed through the submit
    – dennis
    Jun 27, 2012 at 8:06
  • I can't understand why it only posts user_id. It should send the topic_id also because i have a line :<%= f.hidden_field :topic_id, :value => topic.id %>
    – ytsejam
    Jun 27, 2012 at 8:09
  • I suggest trying to specificly assign the key value of topic_id
    – dennis
    Jun 27, 2012 at 8:24
0

Here is the solution for my problem:

posts_controller.rb:

class PostsController < ApplicationController
    before_filter :signed_in_user, only: [:create, :destroy]
  before_filter :correct_user, only: :destroy


    def new
   @topic= Topic.find(params[:topic_id])
   @post = @topic.posts.build
  end

    def create
        @topic= Topic.find(params[:topic_id])
        @post = @topic.posts.build(params[:post])
        @post.user = current_user
        @post.topic_id = @topic.id

        if @post.save
            flash[:success] = "Konu oluşturuldu!"
            redirect_to topic_path(@topic)
        else
            render 'static_pages/home'
        end
    end

  def destroy
    @post.destroy
    redirect_to root_path
  end
  private

    def correct_user
      @post = current_user.posts.find_by_id(params[:id])
      redirect_to root_path if @post.nil?
    end
end

And _post_form.html.erb

  <%= render 'shared/error_messages', object: f.object %>
  <div class="field">


        <%= f.text_area :content, placeholder: "yorumunuzu girin..." %>
  </div>
  <%= f.submit "Gönder", class: "btn btn-large btn-primary" %>
<% end %>

and routes table routes.rb :

resources :topics , only: [:show, :create, :destroy] do
    resources :posts, only: [:create, :new]
    end

I can write a post and it shows in the topics page . I have spent two days for this problem .Thanks for all helps.

1
  • Just a quick note: you don't need @post.topic_id = @topic.id line in create method as topic_id is already set when you build the object Jun 28, 2012 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.