rails/rails — pull request #3340 by surfacedamage (2011-10-16 00:59:11+00:00)
Title: Exclude _destroy parameter in :all_blank check (issue #2937)

When using accepts_nested_attributes_for and a :reject_if => all_blank, the _destroy parameter is also taken into consideration for blank attributes. This can present a situation where a user leaves a form blank for a nested model, submits it, and the nested model record is created anyway.

#### A Contrived Example
A sample model:

class Pirate < ActiveRecord::Base
has_many :ships
accepts_nested_attributes_for :ships, :reject_if => :all_blank, :allow_destroy => true
end

partial rendered html form for pirate:

destroy

submitted parameters will contain:

"ships_attributes"=>{"0"=>{"name"=>"", "_destroy"=>"0"}}

#### Problem

Although the intention is to reject the ship, the _destroy parameter technically has a non-blank value, therefore the ship record would still be created anyway.

#### Strategy

My recommendation for this pull request is to modify the ALL_BLANK proc to ignore the _destroy meta attribute. This would preserve the ability to destroy records by setting it truthy, but reject it if all core model attributes are blank.

#### Issue
https://gist.github.com/rails/rails/issues/2937