views:

20

answers:

1

Im running into a small (newbie) problem.

I've got 2 models: question & reviews.

Reviews schema: question_id, user_id, rating, comments

On the 'show' view, i've integrated the following form (formtastic):

  - semantic_form_for @question.reviews.build do |f|
    = f.error_messages
    = f.input :rating 
    = f.input :comments
    = f.buttons

My reviews controller's create action looks like this:

  def create
    @review = Review.new(params[:review])
    @review.user_id = current_user.id

    if @review.save
      flash[:notice] = "Successfully created review."
      redirect_to(@review.question)
    else
      redirect_to(@review.question)
    end
  end

However, now it simply doesnt seem to save the question id in the question_id field. It does save the user_id nicely.

Does anyone have a clue of what Im doing wrong? If you need logs, let me know! Thanks in advance

+1  A: 

you need to add a hidden field for the question id on your form. something like

f.hidden_field :question_id

To be more specific, user_id is saved because you're assigning it in the controller. You need to pass in the question_id from the form to the controller for it to be saved as well.

semanticart
thx, i figured this could be a solution yes. But, cant the user simply change the value of the field so it changes the value of another question? i thought adding it in the controller would be safer? Or is this no factor? thx again!
Maurice Kroon
You're right that you shouldn't trust anything you don't want potentially altered by the user to hidden fields. You should always do some sort of permissions check to see if the user is able to do what they're trying to do. Ideally that responsibility is encapsulated in an authorization module (i.e. cancan) rather than trying to enforce it in the controller action.Meaning that you should either have a before filter that bails if they don't have permissions *or* the @review.save should fail if they don't have permissions.
semanticart