Unpermitted parameter on turbo-frame-tag with src

1

Hello there, I have a Rails 7 application where I set a default param by overloading default_url_options on ApplicationController so all my routes have an optional locale param that defaults to the application locale, but I get an Unpermitted parameter error when trying to load a view via turbo-frame-tag.

Tried permitting the param but it didn’t work. And if it did, would I have to permit the param in all actions?

Some code…

class ApplicationController < ActionController::Base
  around_action :switch_locale

  def default_url_options
    { locale: I18n.locale }
  end

  private
  def switch_locale(&action)
    # MAYBE THIS IS WHERE THINGS GO WRONG?
    locale = params[:locale] || I18n.default_locale
    I18n.with_locale(locale, &action)
  end
end

All my routes are scoped with this optional param:

# config/routes.rb

Rails.application.routes.draw do
  scope '(/:locale)' do
    resources :users do
      resources :posts
    end
  end
end

All my routes respond to regular resources routes and also with the /:locale scope (e.g. /users/new and /en/users/new)

I want the user to be able to create the post from his own “show” page, so I added it there:

<!-- views/users/show.html.erb -->
<!-- ... -->
<p>Create new post</p>
<%= turbo-frame-tag 'new_user_post', src: new_user_post_url(@user)  %>

But I get the following error on the log when loading the users/show view:

Unpermitted parameter: :locale. Context: { controller: PostsController, action: new, request: ..., params: { "controller" => "posts", "action" => "new", "locale" => "en", "user_id" => "12"} }

In PostsController I have the “posts_params” method permitting the regular things

controllers/posts_controller.rb

...

def post_params
  params.require(:post).permit(:user_id, :title, :body)
end
2

Found the issue, it wasn’t related to the :locale param, but a before_action filter on PostsController that was using the post_params method unnecessarily in a comparison.

Kind reminder to only use the post_params method (params.require(...).permit(...)) when doing mass assignment on model creation or update… :smiley: