Rails not updating attribute

Question

Pretty standard update in my opinion, but upon submitting the put request, the attribute is not updated. Here is my relevant model:

class Vendor < ActiveRecord::Base

    geocoded_by :address
    after_validation :geocode,
        :if => lambda{ |obj| obj.address_changed? }
end

My controller methods:

def edit
    @vendor = Vendor.find(params[:id])
end

def update
    @vendor = Vendor.find(params[:id])
    if @vendor.update_attributes(vendor_params)
        redirect_to vendors_mgmt_path

    else
        render 'edit'
    end
end

def vendor_params
    params.permit(:id, :name, :address, :image, :latitude, :longituded )
end

I see this in the server log after trying to update:

Started PUT "/vendors/1" for 127.0.0.1 at 2013-10-20 20:44:54 -0700
Processing by VendorsController#update as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"fTbZVEfckQz4xQzY5xSMQCArrGZqymNsVeyic/PXKcE=", "vendor"=>{"name"=>"Store", "address"=>"1221 E. Main St."}, "commit"=>"Save changes", "id"=>"1"}
  User Load (0.3ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 1 LIMIT 1
  Vendor Load (0.2ms)  SELECT "vendors".* FROM "vendors" WHERE "vendors"."id" = ? LIMIT 1  [["id", "1"]]
Unpermitted parameters: utf8, _method, authenticity_token, vendor, commit
   (0.1ms)  begin transaction
   (0.1ms)  commit transaction
Redirected to http://localhost:3000/vendors/mgmt
Completed 302 Found in 10ms (ActiveRecord: 0.6ms)

This confuses me, because the Vendor form looks like so, and has no authenticity token etc.

<h1>Update <%= "#{@vendor.name}" %></h1>

<%= form_for(@vendor) do |f| %>
    <%= f.label :name %>
    <%= f.text_field :name %>

    <%= f.label :address %>
    <%= f.text_field :address %>

    <%= f.label :Logo %>
    <%= f.file_field :image %>

    <%= f.submit "Save changes", class: "btn btn-success" %>
<% end %>

Anyone see any glaring errors? Any help is much appreciated. Thanks in advance!

Answer 1

Rails by default includes certain hidden fields in all forms, such as the authenticity_token, which is present to stop CSRF. (More info here) I would recommend changing the line:

params.permit(:id, :name, :address, :image, :latitude, :longituded )

to:

params.require(:vendor).permit(:id, :name, :address, :image, :latitude, :longituded)

Changing this line in your controller should permit the other parameters that are submitted by the form, not just the ones in the vendor param.

Also, you misspelled "longitude", I'm not sure if that's causing any additional trouble or if it's just a typo in your question instead.