无法批量分配受保护的属性

Question

我的features文件看这个:

Given there are the following users:
    | email              | password | admin |
    | admin@ticketee.com | password | true  |

并且我的user模型没有声明admin属性attr_accessible以防止批量分配.因此,我已对user_steps.rb文件进行了更改以解决此问题.

Given /^there are the following users:$/ do |table|
  table.hashes.each do |attributes|
   unconfirmed = attributes.delete("unconfirmed") == "true"
   @user = User.create!(attributes)
   @user.update_attribute("admin", attributes["admin"] == "true")
   @user.confirm! unless unconfirmed
 end
end

现在这应该按照书中的说法--Rails3在行动.我也检查了他们在线仓库的代码.用黄瓜运行它会产生以下错误:

Can't mass-assign protected attributes: admin (ActiveModel::MassAssignmentSecurity::Error)
  ./features/step_definitions/user_steps.rb:4:in `block (2 levels) in <top (required)>'
  ./features/step_definitions/user_steps.rb:2:in `each'
  ./features/step_definitions/user_steps.rb:2:in `/^there are the following users:$/'
  features/creating_projects.feature:7:in `Given there are the following users:'

任何帮助将不胜感激.我真的不知道这里有什么问题.

非常感谢!

Answer 1

在用户模型中添加:

attr_accessible :admin

更新:

该admin属性可以是批量分配的,任何黑客都可以通过使用参数发送它来轻松设置它.