title: Can't mass-assign protected attributes: product, user
body: <p>Hello I'm working in a application where you can vote for a product and from the New action of my vote view I get this error: </p>
  
  <blockquote>
    <p>ActiveModel::MassAssignmentSecurity::Error in VotesController#create</p>
    
    <p>Can't mass-assign protected attributes: product, user</p>
  </blockquote>
  
  <p>I make a test on rails console and it works. So I don't know what it's going on.</p>
  
  <p>Here are the models:</p>
  
  <pre><code>class Product &lt; ActiveRecord::Base
    attr_accessible :title
    has_many :votes
    has_many :users, :through =&gt; :votes
    has_attached_file :photo, :styles =&gt; { :medium =&gt; "300x300" }
  
    before_save { |product| product.title = title.titlecase }
  
    validates :title, presence: true, uniqueness: { case_sensitive: false }
    validates :photo, :attachment_presence =&gt; true
  
  end
  
  class User &lt; ActiveRecord::Base
      has_many :votes
      has_many :products, :through =&gt; :votes
      def self.from_omniauth(auth)
        where(auth.slice(:provider, :uid)).first_or_initialize.tap do |user|
          user.provider = auth.provider
          user.uid = auth.uid
          user.name = auth.info.name
          user.oauth_token = auth.credentials.token
          user.oauth_expires_at = Time.at(auth.credentials.expires_at)
          user.save!
        end
      end
  end
  
  class Vote &lt; ActiveRecord::Base
    attr_accessible :product_id, :user_id
    belongs_to :product
    belongs_to :user
  end
  </code></pre>
  
  <p>Here is the vote controller</p>
  
  <pre><code>class VotesController &lt; ApplicationController
    # GET /votes
    # GET /votes.json
    def index
      @votes = Vote.all
  
      respond_to do |format|
        format.html # index.html.erb
        format.json { render json: @votes }
      end
    end
  
    # GET /votes/1
    # GET /votes/1.json
    def show
      @vote = Vote.find(params[:id])
  
      respond_to do |format|
        format.html # show.html.erb
        format.json { render json: @vote }
      end
    end
  
    # GET /votes/new
    # GET /votes/new.json
    def new
      @vote = Vote.new
  
      respond_to do |format|
        format.html # new.html.erb
        format.json { render json: @vote }
      end
    end
  
    # GET /votes/1/edit
    def edit
      @vote = Vote.find(params[:id])
    end
  
    # POST /votes
    # POST /votes.json
    def create
      @vote = Vote.new(params[:vote])
  
      respond_to do |format|
        if @vote.save
          format.html { redirect_to @vote, notice: 'Vote was successfully created.' }
          format.json { render json: @vote, status: :created, location: @vote }
        else
          format.html { render action: "new" }
          format.json { render json: @vote.errors, status: :unprocessable_entity }
        end
      end
    end
  
    # PUT /votes/1
    # PUT /votes/1.json
    def update
      @vote = Vote.find(params[:id])
  
      respond_to do |format|
        if @vote.update_attributes(params[:vote])
          format.html { redirect_to @vote, notice: 'Vote was successfully updated.' }
          format.json { head :no_content }
        else
          format.html { render action: "edit" }
          format.json { render json: @vote.errors, status: :unprocessable_entity }
        end
      end
    end
  
    # DELETE /votes/1
    # DELETE /votes/1.json
    def destroy
      @vote = Vote.find(params[:id])
      @vote.destroy
  
      respond_to do |format|
        format.html { redirect_to votes_url }
        format.json { head :no_content }
      end
    end
  end
  </code></pre>
  
  <p>and here is the new vote view</p>
  
  <pre><code>&lt;%= form_for(@vote) do |f| %&gt;
    &lt;% if @vote.errors.any? %&gt;
      &lt;div id="error_explanation"&gt;
        &lt;h2&gt;&lt;%= pluralize(@vote.errors.count, "error") %&gt; prohibited this vote from being saved:&lt;/h2&gt;
  
        &lt;ul&gt;
        &lt;% @vote.errors.full_messages.each do |msg| %&gt;
          &lt;li&gt;&lt;%= msg %&gt;&lt;/li&gt;
        &lt;% end %&gt;
        &lt;/ul&gt;
      &lt;/div&gt;
    &lt;% end %&gt;
  
    &lt;div class="field"&gt;
      &lt;%= f.label :product %&gt;&lt;br /&gt;
      &lt;%= f.text_field :product %&gt;
    &lt;/div&gt;
    &lt;div class="field"&gt;
      &lt;%= f.label :user %&gt;&lt;br /&gt;
      &lt;%= f.text_field :user %&gt;
    &lt;/div&gt;
    &lt;div class="actions"&gt;
      &lt;%= f.submit %&gt;
    &lt;/div&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>Please I really need your help to solve this issues, it was very difficult to find a tutorial with has_many :through that include the complete MVC example, I think my problem is on the view, but I don't know.</p>
  
  <p>Thanks!</p>