Ruby on rails 嵌套表单：如何设置子资源的用户ID？

我正试图让我的

用户

以

速率保存。通过删除状态验证，我可以将
位置
保存到速率，但创建后，它没有当前用户。我将如何为嵌套表单执行此操作

User.rb

attr_accessible :email, :password
has_many :locations
has_many :rates

attr_accessible :name, :rates_attributes
belongs_to :user
has_many :rates
accepts_nested_attributes_for :rates, :reject_if => :all_blank
# Not sure if :all_blank works anyways as it - 
# still saves even when theirs no user_id, lol

attr_accessible :amount, :location_id
belongs_to :location
belongs_to :user
validates_presence_of :amount
# Couldn't use these validations
# validates_presence_of :user_id 
# validates_presence_of :location_id

<%= nested_form_for @location do |f| %>
  <%= f.label :name, "Name *" %>
  <%= f.text_field :name  %>

  <%= f.link_to_add "Add Rate", :rates %>
  <%= f.fields_for :rates do |r| %>
    <%= r.text_field :amount %>
    <%= r.link_to_remove "Remove" %>
  <% end %>
  <%= f.submit "Add Location" %>
<% end %>

位置.rb

attr_accessible :email, :password
has_many :locations
has_many :rates

attr_accessible :name, :rates_attributes
belongs_to :user
has_many :rates
accepts_nested_attributes_for :rates, :reject_if => :all_blank
# Not sure if :all_blank works anyways as it - 
# still saves even when theirs no user_id, lol

attr_accessible :amount, :location_id
belongs_to :location
belongs_to :user
validates_presence_of :amount
# Couldn't use these validations
# validates_presence_of :user_id 
# validates_presence_of :location_id

<%= nested_form_for @location do |f| %>
  <%= f.label :name, "Name *" %>
  <%= f.text_field :name  %>

  <%= f.link_to_add "Add Rate", :rates %>
  <%= f.fields_for :rates do |r| %>
    <%= r.text_field :amount %>
    <%= r.link_to_remove "Remove" %>
  <% end %>
  <%= f.submit "Add Location" %>
<% end %>

利率.rb

attr_accessible :email, :password
has_many :locations
has_many :rates

attr_accessible :name, :rates_attributes
belongs_to :user
has_many :rates
accepts_nested_attributes_for :rates, :reject_if => :all_blank
# Not sure if :all_blank works anyways as it - 
# still saves even when theirs no user_id, lol

attr_accessible :amount, :location_id
belongs_to :location
belongs_to :user
validates_presence_of :amount
# Couldn't use these validations
# validates_presence_of :user_id 
# validates_presence_of :location_id

<%= nested_form_for @location do |f| %>
  <%= f.label :name, "Name *" %>
  <%= f.text_field :name  %>

  <%= f.link_to_add "Add Rate", :rates %>
  <%= f.fields_for :rates do |r| %>
    <%= r.text_field :amount %>
    <%= r.link_to_remove "Remove" %>
  <% end %>
  <%= f.submit "Add Location" %>
<% end %>

位置控制器

def new
  @location = Location.new
  @location.rates.build
end

def create
  @location = current_user.locations.build(params[:location])
  if @location.save.....
end

locations/new.html.erb

attr_accessible :email, :password
has_many :locations
has_many :rates

attr_accessible :name, :rates_attributes
belongs_to :user
has_many :rates
accepts_nested_attributes_for :rates, :reject_if => :all_blank
# Not sure if :all_blank works anyways as it - 
# still saves even when theirs no user_id, lol

attr_accessible :amount, :location_id
belongs_to :location
belongs_to :user
validates_presence_of :amount
# Couldn't use these validations
# validates_presence_of :user_id 
# validates_presence_of :location_id

<%= nested_form_for @location do |f| %>
  <%= f.label :name, "Name *" %>
  <%= f.text_field :name  %>

  <%= f.link_to_add "Add Rate", :rates %>
  <%= f.fields_for :rates do |r| %>
    <%= r.text_field :amount %>
    <%= r.link_to_remove "Remove" %>
  <% end %>
  <%= f.submit "Add Location" %>
<% end %>

在这个话题上有一个很棒的railscast；第196和197集。更妙的是，瑞安写了一本《宝石》

gem非常容易实现。如果设置正确，嵌套表单会自动在创建时获取父对象id

我没有注意到您发布的代码中有任何错误……您的嵌套表单在视图中是什么样子的？
这就是我学习如何创建嵌套表单的地方。我的问题是如何获得
用户id
。用户不是父用户，位置是。我可能会在嵌套形式中执行类似操作：current_user%>但这不会提供安全漏洞吗？黑客可以传递不同的“用户id”并制造来自不同人的消息，对吗？