title: Rails 4 strong params and nested form
body: <p>I'm building a simple app (Ruby 2.0.0 and Rails 4) where a user can create a project and for each project create multiple screens. When creating a screen the user can upload a screenshot, that refer to a its own model (I do this to handle multiple versions of the same screen).</p>
  
  <p>When creating the screen, the screenshot doesn't seem to be created because of a permission problem. Here's the server log:</p>
  
  <pre><code>Processing by ScreensController#create as HTML
  Parameters: {"utf8"=&gt;"✓", "authenticity_token"=&gt;"kezaGADsaLmY/+zozgbjEe5UfdeqRPg58FCf1qzfHxY=", "screen"=&gt;{"project_id"=&gt;"24", "name"=&gt;"Billing", "description"=&gt;"This is the page where a user will enter their credit card information", "screenshot"=&gt;{"image"=&gt;#  &lt;ActionDispatch::Http::UploadedFile:0x007fcdce25b2c0 @tempfile=#&lt;Tempfile:/var/folders/pv/srwrv0qj35b0hsxkt42l_z500000gn/T/RackMultipart20131007-91790-tewse9&gt;, @original_filename="fb-banner.png", @content_type="image/png", @headers="Content-Disposition: form-data; name=\"screen[screenshot][image]\"; filename=\"fb-banner.png\"\r\nContent-Type: image/png\r\n"&gt;}}, "commit"=&gt;"Create Screen"}
  Unpermitted parameters: screenshot
  </code></pre>
  
  <p>These are my models:</p>
  
  <p>Screen</p>
  
  <pre><code>class Screen &lt; ActiveRecord::Base
  
    belongs_to :project
    has_many :screenshots
  
    validates :name, presence: true
  
    accepts_nested_attributes_for :screenshots
  
  end
  </code></pre>
  
  <p>Screenshot</p>
  
  <pre><code>class Screenshot &lt; ActiveRecord::Base
  
    belongs_to :screen
  
  end
  </code></pre>
  
  <p>This is my screens_controller:</p>
  
  <pre><code>class ScreensController &lt; ApplicationController
    before_action :set_screen, only: [:show, :edit, :update, :destroy]
  
  
    def index
      @screens = Screen.all
    end
  
  
    def show
    end
  
  
    def new
      @screen = Screen.new(:project_id =&gt; params[:project_id])
      @screen.screenshot.build
    end
  
  
    def edit
    end
  
  
    def create
      @screen = Screen.create(screen_params)
      if @screen.save
        flash[:notice] = "A new screen has been added to this project"
        redirect_to [@screen.project]
      else
        render :action =&gt; 'new'
      end
    end
  
  
    def update
      @screen = Screen.find(params[:id])
      if @screen.update_attributes(screen_params)
        flash[:notice] = "The screen has been successfully updated"
        redirect_to [@screen.project]
      else
        render :action =&gt; 'edit'
      end
    end
  
    def destroy
      @screen = Screen.find(params[:id])
      @screen.destroy
      flash[:notice] = "Successfully destroyed screen"
      redirect_to [@screen.project]
    end
  
    private
      def set_screen
        @screen = Screen.find(params[:id])
      end
  
      def screen_params
        params.require(:screen).permit(:project_id, :name, :description, screenshot_attributes: [ :id, :screen_id, :image, :version ])
      end
  end
  </code></pre>
  
  <p>And finally this is the form:</p>
  
  <pre><code>&lt;%= form_for @screen, :html =&gt; { :multipart =&gt; true } do |f| %&gt;
    &lt;% if @screen.errors.any? %&gt;
      &lt;div id="error_explanation"&gt;
        &lt;h2&gt;&lt;%= pluralize(@screen.errors.count, "error") %&gt; prohibited this screen from being saved:&lt;/h2&gt;
  
        &lt;ul&gt;
        &lt;% @screen.errors.full_messages.each do |msg| %&gt;
          &lt;li&gt;&lt;%= msg %&gt;&lt;/li&gt;
        &lt;% end %&gt;
        &lt;/ul&gt;
      &lt;/div&gt;
    &lt;% end %&gt;
  
    &lt;div class="field"&gt;
      &lt;%= f.hidden_field :project_id %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :name %&gt;&lt;br&gt;
      &lt;%= f.text_field :name %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :description %&gt;&lt;br&gt;
      &lt;%= f.text_field :description %&gt;
    &lt;/div&gt;
  
    &lt;%= f.fields_for :screenshot do |s| %&gt;
      &lt;%= s.hidden_field :screen_id, :value =&gt; @screen.id %&gt;
      &lt;%= s.hidden_field :version, :value =&gt; "1" %&gt;
      &lt;%= s.label :image %&gt;&lt;br&gt;
      &lt;%= s.file_field :image %&gt;
    &lt;% end %&gt;
  
    &lt;div class="actions"&gt;
      &lt;%= f.submit %&gt;
    &lt;/div&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>I hope this is enough to help me spot the problem. I'm a newbie when it comes to programming, so any help is more than welcome.</p>