title: Nested attributes unpermitted parameters
body: <p>I have a <code>Bill</code> object, which has many <code>Due</code> objects. The <code>Due</code> object also belongs to a <code>Person</code>. I want a form that can create the <code>Bill</code> and its children <code>Dues</code> all in one page. I am trying to create a form using nested attributes, similar to ones in <a href="http://railscasts.com/episodes/196-nested-model-form-part-1" rel="noreferrer">this Railscast</a>.</p>
  
  <p>Relevant code is listed below:</p>
  
  <p><strong>due.rb</strong></p>
  
  <pre><code>class Due &lt; ActiveRecord::Base
      belongs_to :person
      belongs_to :bill
  end
  </code></pre>
  
  <p><strong>bill.rb</strong></p>
  
  <pre><code>class Bill &lt; ActiveRecord::Base
      has_many :dues, :dependent =&gt; :destroy 
      accepts_nested_attributes_for :dues, :allow_destroy =&gt; true
  end
  </code></pre>
  
  <p><strong>bills_controller.rb</strong></p>
  
  <pre><code>  # GET /bills/new
    def new
        @bill = Bill.new
        3.times { @bill.dues.build }
    end
  </code></pre>
  
  <p><strong>bills/_form.html.erb</strong></p>
  
  <pre><code>  &lt;%= form_for(@bill) do |f| %&gt;
      &lt;div class="field"&gt;
          &lt;%= f.label :company %&gt;&lt;br /&gt;
          &lt;%= f.text_field :company %&gt;
      &lt;/div&gt;
      &lt;div class="field"&gt;
          &lt;%= f.label :month %&gt;&lt;br /&gt;
          &lt;%= f.text_field :month %&gt;
      &lt;/div&gt;
      &lt;div class="field"&gt;
          &lt;%= f.label :year %&gt;&lt;br /&gt;
          &lt;%= f.number_field :year %&gt;
      &lt;/div&gt;
      &lt;div class="actions"&gt;
          &lt;%= f.submit %&gt;
      &lt;/div&gt;
      &lt;%= f.fields_for :dues do |builder| %&gt;
          &lt;%= render 'due_fields', :f =&gt; builder %&gt;
      &lt;% end %&gt;
    &lt;% end %&gt;
  </code></pre>
  
  <p><strong>bills/_due_fields.html.erb</strong></p>
  
  <pre><code>&lt;div&gt;
      &lt;%= f.label :amount, "Amount" %&gt;        
      &lt;%= f.text_field :amount %&gt;
      &lt;br&gt;
      &lt;%= f.label :person_id, "Renter" %&gt;
      &lt;%= f.text_field :person_id %&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p><strong>UPDATE to bills_controller.rb</strong>
  This works!</p>
  
  <pre><code>def bill_params 
    params
    .require(:bill)
    .permit(:company, :month, :year, dues_attributes: [:amount, :person_id]) 
  end
  </code></pre>
  
  <p>The proper fields are rendered on the page (albeit without a dropdown for <code>Person</code> yet) and submit is successful. However, none of the children dues are saved to the database, and an error is thrown in the server log: </p>
  
  <pre><code>Unpermitted parameters: dues_attributes
  </code></pre>
  
  <p>Just before the error, the log displays this:</p>
  
  <pre><code>Started POST "/bills" for 127.0.0.1 at 2013-04-10 00:16:37 -0700
  Processing by BillsController#create as HTML&lt;br&gt;
  Parameters: {"utf8"=&gt;"✓", 
  "authenticity_token"=&gt;"ipxBOLOjx68fwvfmsMG3FecV/q/hPqUHsluBCPN2BeU=",
   "bill"=&gt;{"company"=&gt;"Comcast", "month"=&gt;"April ", 
  "year"=&gt;"2013", "dues_attributes"=&gt;{
  "0"=&gt;{"amount"=&gt;"30", "person_id"=&gt;"1"}, 
  "1"=&gt;{"amount"=&gt;"30", "person_id"=&gt;"2"},
   "2"=&gt;{"amount"=&gt;"30", "person_id"=&gt;"3"}}}, "commit"=&gt;"Create Bill"}
  </code></pre>
  
  <p>Has there been some change in Rails 4?</p>