I fixed wrongly } instead of )
dokuzbir
Almog
Thanks that was it and I think it’s working I am getting the following error which I’m guessing it has to do with the user id
Postgrex expected a binary of 16 bytes, got 1. Please make sure the value you are passing matches the definition in your table or in your query or convert the value accordingly.
0
Almog
This is my db object
schema "magnets" do
field :content, :string
field :description, :string
field :title, :string
belongs_to :user, Magnify.Coherence.User
many_to_many :fluxes, Magnify.Magnets.Flux, join_through: "magnets_fluxes"
timestamps()
end
0
idi527
Passing :user_id or any other foreign key into a changeset cast is an invitation for breaking into the system …
0
Almog
idi527
tl;dr
Just don’t put it into the params / changeset. Treat the params as an opaque data structure.
# in your controller
def create(conn, %{"magnet" => magnet_params}) do
case Magnets.create_magnet(magnet_params, for: conn.assigns.current_user) do
{:ok, magnet} ->
conn
|> put_flash(:info, "Magnet created successfully.")
|> redirect(to: magnet_path(conn, :show, magnet))
{:error, %Ecto.Changeset{} = changeset} ->
render(conn, "new.html", changeset: changeset)
end
end
# in your business logic module
def create_magnet(attrs, for: %User{id: user_id}) do
%Magnet{user_id: user_id}
|> Magnet.changeset(attrs)
|> Repo.insert()
end
# in the module where you schema / changesets are defined
def changeset(manget, attrs) do
magnet
|> cast(attrs, [:title, :description, :content])
|> validate_required([:title, :description, :content])
end
1
dokuzbir
I guessed so but i saw that example at thechangelog project so that made me think this is right too. Thanks for help
0
Almog
I tried doing that, i.e. having in the schema did " |> cast_assoc(:user)"
but it’s null, did you see my first post
0
idi527
guessed so but i saw that example at thechangelog project so that made me think this is right too.
You might want to warn them about it. As I’ve mentioned before, this approach (casting foreign keys inside the changeset functions) allowed me to gain write access to any record in one shop’s database once.
0
idi527
I’m not suggesting using |> cast_assoc(:user). What I am suggesting is putting the user_id inside the magnet struct before sending it into the changeset function.
0