aboutsummaryrefslogtreecommitdiffstats
path: root/guides
diff options
context:
space:
mode:
authorPaul Nikitochkin <paul.nikitochkin@gmail.com>2013-06-30 22:46:35 +0300
committerPaul Nikitochkin <paul.nikitochkin@gmail.com>2013-06-30 22:54:19 +0300
commit24ec5697c5ed132784ad5d7a591f391f5e141ace (patch)
tree1ff14297cd569fed1c705d63a9a1e1b06781a2ea /guides
parent996f9b5873e80cfc2255b4e28755165fc8e55d83 (diff)
downloadrails-24ec5697c5ed132784ad5d7a591f391f5e141ace.tar.gz
rails-24ec5697c5ed132784ad5d7a591f391f5e141ace.tar.bz2
rails-24ec5697c5ed132784ad5d7a591f391f5e141ace.zip
Removed params permit step from 5.6 section [ci skip]
Diffstat (limited to 'guides')
-rw-r--r--guides/source/getting_started.md23
1 files changed, 10 insertions, 13 deletions
diff --git a/guides/source/getting_started.md b/guides/source/getting_started.md
index 26360e815b..f54427f31b 100644
--- a/guides/source/getting_started.md
+++ b/guides/source/getting_started.md
@@ -531,27 +531,19 @@ and change the `create` action to look like this:
```ruby
def create
- @post = Post.new(post_params)
+ @post = Post.new(params[:post])
@post.save
redirect_to @post
end
-
-private
- def post_params
- params.require(:post).permit(:title, :text)
- end
```
Here's what's going on: every Rails model can be initialized with its
respective attributes, which are automatically mapped to the respective
-database columns. In the first line we do just that (remember that
-`post_params` contains the attributes we're interested in). Then,
-`@post.save` is responsible for saving the model in the database.
-Finally, we redirect the user to the `show` action,
-which we'll define later.
-
-TIP: Note that `def post_params` is private. This new approach prevents an attacker from setting the model's attributes by manipulating the hash passed to the model. For more information, refer to [this blog post about Strong Parameters](http://weblog.rubyonrails.org/2012/3/21/strong-parameters/).
+database columns. In the first line we do just that
+(remember that `params[:post]` contains the attributes we're interested in).
+Then, `@post.save` is responsible for saving the model in the database.
+Finally, we redirect the user to the `show` action, which we'll define later.
TIP: As we'll see later, `@post.save` returns a boolean indicating
whether the model was saved or not.
@@ -631,6 +623,11 @@ Visit <http://localhost:3000/posts/new> and give it a try!
![Show action for posts](images/getting_started/show_action_for_posts.png)
+TIP: Note that `def post_params` is private. This new approach prevents an attacker from
+setting the model's attributes by manipulating the hash passed to the model.
+For more information, refer to
+[this blog post about Strong Parameters](http://weblog.rubyonrails.org/2012/3/21/strong-parameters/).
+
### Listing all posts
We still need a way to list all our posts, so let's do that.