Add all generated attributes to attr_accessible whitelist. #1578.

core/lib/generators/refinery/engine/templates/app/models/refinery/namespace/singular_name.rb

@@ -1,30 +1,34 @@
 module Refinery
   module <%= namespacing %>
     class <%= class_name %> < Refinery::Core::BaseModel
-      <% if table_name == namespacing.underscore.pluralize -%>self.table_name = 'refinery_<%= plural_name %>'<% end -%>
-      <% if localized? %>
-      translates <%= localized_attributes.map{|a| ":#{a.name}"}.join(', ') %><% end %>
-    <% if (string_attributes = attributes.select{ |a| a.type.to_s =~ /string|text/ }.uniq).any? %>
-      attr_accessible <%= string_attributes.first.name.to_sym.inspect %>, :position
+<% if table_name == namespacing.underscore.pluralize -%>
+      self.table_name = 'refinery_<%= plural_name %>'
+<% end %>
+      attr_accessible <%= attributes.map { |attr| ":#{attr.name}" }.join(', ') %>, :position
+<% if localized? -%>
+
+      translates <%= localized_attributes.map{|a| ":#{a.name}"}.join(', ') %>
+<% end -%>
+<% if (string_attributes = attributes.select{ |a| a.type.to_s =~ /string|text/ }.uniq).any? -%>
 
       acts_as_indexed :fields => <%= string_attributes.map{|s| s.name.to_sym}.inspect %>
 
       validates <%= string_attributes.first.name.to_sym.inspect %>, :presence => true, :uniqueness => true
-      <% else %>
+<% else %>
       # def title was created automatically because you didn't specify a string field
       # when you ran the refinery:engine generator. <3 <3 Refinery CMS.
       def title
         "Override def title in vendor/extensions/<%= namespacing.underscore %>/app/models/refinery/<%= namespacing.underscore %>/<%= singular_name %>.rb"
       end
-      <% end -%>
-    <% attributes.select{|a| a.type.to_s == 'image'}.uniq.each do |a| -%>
+<% end -%>
+<% attributes.select{|a| a.type.to_s == 'image'}.uniq.each do |a| -%>
 
       belongs_to :<%= a.name.gsub("_id", "") -%>, :class_name => '::Refinery::Image'
-    <% end -%>
-    <% attributes.select{|a| a.type.to_s == 'resource'}.uniq.each do |a| -%>
+<% end -%>
+<% attributes.select{|a| a.type.to_s == 'resource'}.uniq.each do |a| -%>
 
       belongs_to :<%= a.name.gsub("_id", "") %>, :class_name => '::Refinery::Resource'
-    <% end %>
+<% end %>
     end
   end
 end

core/lib/generators/refinery/form/templates/app/models/refinery/namespace/singular_name.rb

@@ -3,11 +3,13 @@ module <%= class_name.pluralize %>
     class <%= class_name %> < Refinery::Core::BaseModel
 <% if table_name == namespacing.underscore.pluralize -%>
       self.table_name = 'refinery_<%= plural_name %>'
-<% end -%>
-<% if (text_or_string_fields = attributes.map{ |a| a.name if a.type.to_s =~ /string|text/ }.compact.uniq).any? %>
+<% end %>
+      attr_accessible <%= attributes.map { |attr| ":#{attr.name}" }.join(', ') %>, :position
+
+<% if (text_or_string_fields = attributes.map{ |a| a.name if a.type.to_s =~ /string|text/ }.compact.uniq).any? -%>
       acts_as_indexed :fields => [:<%= text_or_string_fields.join(", :") %>]
 <% end -%>
-<% if (text_fields = attributes.map {|a| a.name if a.type.to_s == 'text'}.compact.uniq).any? && text_fields.detect{|a| a.to_s == 'message'}.nil? %>
+<% if (text_fields = attributes.map {|a| a.name if a.type.to_s == 'text'}.compact.uniq).any? && text_fields.detect{|a| a.to_s == 'message'}.nil? -%>
       alias_attribute :message, :<%= text_fields.first %>
 <% elsif text_fields.empty? %>
       # def message was created automatically because you didn't specify a text field