title: Unpermitted parameters on multiple paperclip file uploads Rails4
body: <p>I've got a ruby 2.0.0 and rails 4.0.0 app that has a 'Guitar' and 'Photos' model. I've used paperclip to upload a single file in Rails3, but am new to uploading multiple files in Rails 4. I created the second model to hold said photos, and read up on strong parameters, etc. I'm getting an error when attempting to add 3 photos to a guitar. In the logs: "Unpermitted parameters: photos_attributes". I've tried adding photos_attributes to the whitelist and no joy. I'm pulling my hair out here - there's no error in the web view, but when I console in and type 'Photo.all', I get nothing. What am I doing wrong? I'm kind of a newbie, please be gentle.</p>
  
  <p>guitar.rb</p>
  
  <pre><code>class Guitar &lt; ActiveRecord::Base
    belongs_to :user
    has_many :photos
    accepts_nested_attributes_for :photos
  end
  </code></pre>
  
  <p>photo.rb</p>
  
  <pre><code>class Photo &lt; ActiveRecord::Base
    belongs_to :guitar
  
    has_attached_file :photo, styles: {                                                                                          
      thumb: '100x100&gt;',                                                          
      square: '200x200#',                                                         
      medium: '300x300&gt;',                                                         
      large: '600x6003'                                                           
    }
  end
  </code></pre>
  
  <p>guitars_controller.rb</p>
  
  <pre><code>class GuitarsController &lt; ApplicationController
    before_action :set_guitar, only: [:show, :edit, :update, :destroy]
  
    # GET /guitars
    # GET /guitars.json
    def index
      @guitars = Guitar.all
    end
  
    # GET /guitars/1
    # GET /guitars/1.json
    def show
    end
  
    # GET /guitars/new
    def new
      @guitar = current_user.guitars.build
      3.times {@guitar.photos.build}
    end
  
    # GET /guitars/1/edit
    def edit
      3.times {@guitar.photos.build}
    end
  
    # POST /guitars
    # POST /guitars.json
    def create
      @guitar = current_user.guitars.build(guitar_params)
  
      respond_to do |format|
        if @guitar.save
      format.html { redirect_to @guitar, notice: 'Guitar was successfully created.' }
      format.json { render action: 'show', status: :created, location: @guitar }
        else
      format.html { render action: 'new' }
      format.json { render json: @guitar.errors, status: :unprocessable_entity }
        end
      end
    end
  
    # PATCH/PUT /guitars/1
    # PATCH/PUT /guitars/1.json
    def update
      respond_to do |format|
        if @guitar.update(guitar_params)
      format.html { redirect_to @guitar, notice: 'Guitar was successfully updated.' }
      format.json { head :no_content }
        else
      format.html { render action: 'edit' }
      format.json { render json: @guitar.errors, status: :unprocessable_entity }
        end
      end
    end
  
    # DELETE /guitars/1
    # DELETE /guitars/1.json
    def destroy
      @guitar.destroy
      respond_to do |format|
        format.html { redirect_to guitars_url }
        format.json { head :no_content }
      end
    end
  
    private
      # Use callbacks to share common setup or constraints between actions.
      def set_guitar
        @guitar = Guitar.find(params[:id])
      end
  
      # Never trust parameters from the scary internet, only allow the white list through.
      def guitar_params
        params.require(:guitar).permit(:make, :model, :year, :color, :serial, :price, :condition, :kind, :bodykind, :frets, :oneowner, :user_id, :description, :photos_attributes)
      end
  end
  </code></pre>
  
  <p>views/guitar/_form.html.erb</p>
  
  <pre><code>&lt;%= form_for @guitar, :html =&gt; { :multipart =&gt; true } do |f| %&gt;
    &lt;% if @guitar.errors.any? %&gt;
      &lt;div id="error_explanation"&gt;
        &lt;h2&gt;&lt;%= pluralize(@guitar.errors.count, "error") %&gt; prohibited this guitar from being saved:&lt;/h2&gt;
  
        &lt;ul&gt;
        &lt;% @guitar.errors.full_messages.each do |msg| %&gt;
      &lt;li&gt;&lt;%= msg %&gt;&lt;/li&gt;
        &lt;% end %&gt;
        &lt;/ul&gt;
      &lt;/div&gt;
    &lt;% end %&gt;
  
    &lt;div class="field"&gt;
      &lt;%= f.label :make %&gt;&lt;br&gt;
      &lt;%= f.text_field :make %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :model %&gt;&lt;br&gt;
      &lt;%= f.text_field :model %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :year %&gt;&lt;br&gt;
      &lt;%= f.text_field :year %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :color %&gt;&lt;br&gt;
      &lt;%= f.text_field :color %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :serial %&gt;&lt;br&gt;
      &lt;%= f.text_field :serial %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :price %&gt;&lt;br&gt;
      &lt;%= f.text_field :price %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :condition %&gt;&lt;br&gt;
      &lt;%= f.number_field :condition %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :kind %&gt;&lt;br&gt;
      &lt;%= f.text_field :kind %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :bodykind %&gt;&lt;br&gt;
      &lt;%= f.text_field :bodykind %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :frets %&gt;&lt;br&gt;
      &lt;%= f.text_field :frets %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :oneowner %&gt;&lt;br&gt;
      &lt;%= f.check_box :oneowner %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :extended_description %&gt;&lt;br&gt;
      &lt;%= f.text_area :description %&gt;
    &lt;/div&gt;
  
    &lt;%= f.fields_for :photos do |builder| %&gt;
      &lt;%= builder.label :photo, "Image File" %&gt;
      &lt;%= builder.file_field :photo %&gt;
    &lt;% end %&gt;
  
    &lt;div class="actions"&gt;
      &lt;%= f.submit %&gt;
    &lt;/div&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>db/schema.rb</p>
  
  <pre><code>ActiveRecord::Schema.define(version: 20131014195859) do
  
    create_table "guitars", force: true do |t|
      t.string   "make"
      t.string   "model"
      t.string   "year"
      t.string   "color"
      t.string   "serial"
      t.string   "price"
      t.integer  "condition"
      t.string   "kind"
      t.string   "bodykind"
      t.string   "frets"
      t.boolean  "oneowner"
      t.integer  "user_id"
      t.datetime "created_at"
      t.datetime "updated_at"
      t.string   "description"
    end
  
    add_index "guitars", ["user_id"], name: "index_guitars_on_user_id", using: :btree
  
    create_table "photos", force: true do |t|
      t.integer  "guitar_id"
      t.datetime "created_at"
      t.datetime "updated_at"
      t.string   "photo_file_name"
      t.string   "photo_content_type"
      t.integer  "photo_file_size"
      t.datetime "photo_updated_at"
    end
  
    create_table "users", force: true do |t|
      t.string   "email",                  default: "", null: false
      t.string   "encrypted_password",     default: "", null: false
      t.string   "reset_password_token"
      t.datetime "reset_password_sent_at"
      t.datetime "remember_created_at"
      t.integer  "sign_in_count",          default: 0,  null: false
      t.datetime "current_sign_in_at"
      t.datetime "last_sign_in_at"
      t.string   "current_sign_in_ip"
      t.string   "last_sign_in_ip"
      t.datetime "created_at"
      t.datetime "updated_at"
      t.string   "city"
      t.string   "state"
    end
  
    add_index "users", ["email"], name: "index_users_on_email", unique: true, using: :btree
    add_index "users", ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true, using: :btree
  
  end
  </code></pre>