title: ForbiddenAttributesError error when building from a has_many relationship
body: <h2>New updates</h2>
  
  <p>Moved params permit responsability from model to controller and used comment_attributes instead of comments as @vinodadhikary pointed me</p>
  
  <p>Using better_errors REPL, I traced the problem down to <code>sanitize_for_mass_assignment</code> method. When doing <code>attributes.permitted?</code> it returns <code>false</code>. But doing <code>attributes.permit(:article_id, :name, :email, :body)</code> returns me exactly que entry parameters!:</p>
  
  <pre><code>&gt;&gt; attributes
  =&gt; {"name"=&gt;"Commenter", "email"=&gt;"commenter@mail.com", "body"=&gt;"Here is the comment &gt;&gt; body!! :D"}
  &gt;&gt; attributes.permit(:article_id, :name, :email, :body)
  =&gt; {"name"=&gt;"Commenter", "email"=&gt;"commenter@mail.com", "body"=&gt;"Here is the comment body!! :D"}
  &gt;&gt; attributes.permitted?
  =&gt; false
  </code></pre>
  
  <h2>Context and code</h2>
  
  <p>Trying to get in touch with Rails 4, I encountered a problem with (I think) strong parameters use.</p>
  
  <p>I have an Article class which can have many Comments. When creating a new comment doing:</p>
  
  <pre><code>@comment = @article.comments.build(params[:comment])
  </code></pre>
  
  <p>I get the following error (pointing this line):</p>
  
  <blockquote>
    <p>ActiveModel::ForbiddenAttributesError at /articles/1/comments</p>
  </blockquote>
  
  <p>The models are the following:</p>
  
  <pre><code>class Article &lt; ActiveRecord::Base
    validates_presence_of :title, :content
    validates_uniqueness_of :title
  
    has_many  :comments, :dependent =&gt; :destroy
    accepts_nested_attributes_for :comments
  end
  </code></pre>
  
  <p>Comments:</p>
  
  <pre><code>class Comment &lt; ActiveRecord::Base
    belongs_to :article
  
   validates_presence_of :article_id, :author, :body, :content
  end
  </code></pre>
  
  <p><strong>Article controller</strong> have this in the private section:</p>
  
  <pre><code>def article_params
    params.require(:article).permit(:title, :content, comments_attributes: [:article_id, :name, :email, :body])
  end
  </code></pre>
  
  <p><strong>Comments</strong> controller code is:</p>
  
  <pre><code>def create
    @article = Article.find(params[:article_id])
    @comment = @article.comments.build(params[:comment]) # &lt;--- It fails here
  
    respond_to do |format|
      if @comment.save
        format.html { redirect_to @comment, notice: 'Comment was successfully created.' }
        format.json { render action: 'show', status: :created, location: @comment }
      else
        format.html { render action: 'new' }
        format.json { render json: @comment.errors, status: :unprocessable_entity }
      end
    end
  end
  </code></pre>