Getting Mass Assignment warning but don't know why

I am very confused by the following warning about mass assignment:

WARNING: Can't mass-assign protected attributes: upload_id

Here is my uploads model:

class Upload < ActiveRecord::Base
    belongs_to :uploadable, :polymorphic => true
    attr_accessor :crop_x, :crop_y, :crop_w, :crop_h
    has_attached_file :photo, :styles => { :thumb => '40x40#', :medium =开发者_运维知识库> '150x150>', :large => '300x300>'}

Here is my user model

class User < ActiveRecord::Base

  has_one  :upload, :as => :uploadable
  attr_accessible :name, :email, :password, :password_confirmation, :birthdate, :emails, :icon_id 

There is no :upload_id in the models.

In the controller update action:

def update
    @user.upload = Upload.find_by_id(params[:user][:upload_id]) 
    respond_to do |format|
      if  @user.update_attributes(:user)
        format.js
      end
    end
end

Can anyone tell why I get this error. The application works but I would like to fix this.

In the model, add :upload_id to the attr_accessible inputs, like so:

attr_accessible :name, :email, ... :emails, :icon_id, :upload_id

If you want the :upload_id to be nested under :user in the params hash, it needs to be listed as an accessible attribute for the user model.