ruby-on-rails - 是否可以在 Rails 控制器中链接强参数

Question

我目前正在这样做

class DetailsController < ApplicationController
  def create
    @detail = Detail.new(params.require(:detail).permit(:user_id, :note))
    if @detail.save
      redirect_to @detail
    else
      render 'new'
    end
  end
  
  def update
    @detail = Detail.find(params[:id])
    if @detail.update(detail_params)
      redirect_to @detail
    else
      render 'edit'
    end
  end
  
  private
  def detail_params
    params.require(:detail).permit(:note)
  end  
end

在 Rails 中是否有可能过于链接强参数？我试过这样做，但没有奏效

class DetailsController < ApplicationController
  def create
    @detail = Detail.new(detail_params.permit(:user_id))
    if @detail.save
      redirect_to @detail
    else
      render 'new'
    end
  end
  
  def update
    @detail = Detail.find(params[:id])
    if @detail.update(detail_params)
      redirect_to @detail
    else
      render 'edit'
    end
  end
  
  private
  def detail_params
    params.require(:detail).permit(:note)
  end  
end

标签： ruby-on-railsstrong-parameters

Answer 1

为了把事情弄干，我使用了tap方法并做了这样的事情......

 def detail_params(is_create = false)
   params.require(:detail).permit(:note).tap do |p|
     p[:user_id] = current_user.id if is_create
   end
 end 

  def create
    @detail = Detail.new(detail_params(true))
    if @detail.save
      redirect_to @detail
    else
      render 'new'
    end
  end


  def update
    @detail = Detail.find(params[:id])
    if @detail.update(detail_params)
      redirect_to @detail
    else
      render 'edit'
    end
  end

只是有不同的参数集，这有效......

 def detail_params(is_create = false)
   permitted = [:note]
   permitted << :user_id if is_create
   params.require(:detail).permit(permitted)
 end