From d588fb00dad4ad5fdfe81a50cae8e3009140ee01 Mon Sep 17 00:00:00 2001 From: Henne Vogelsang Date: Tue, 17 Mar 2026 15:55:22 +0100 Subject: [PATCH] Fix too loose strong Booth parameters People should not be able to change the state, conference or timestamps of booths. --- app/controllers/booths_controller.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/app/controllers/booths_controller.rb b/app/controllers/booths_controller.rb index f8057637..c3a34d63 100644 --- a/app/controllers/booths_controller.rb +++ b/app/controllers/booths_controller.rb @@ -94,7 +94,6 @@ class BoothsController < ApplicationController private def booth_params - params.require(:booth).permit(:title, :description, :reasoning, :state, :picture, :conference_id, - :created_at, :updated_at, :submitter_relationship, :website_url, responsible_ids: []) + params.require(:booth).permit(:title, :description, :reasoning, :picture, :website_url, :submitter_relationship, responsible_ids: []) end end