test/dummy/app/controllers/registrations_controller.rb in merit-1.5.0 vs test/dummy/app/controllers/registrations_controller.rb in merit-1.6.0

@@ -1,15 +1,21 @@
 class RegistrationsController < ApplicationController
   def update
     @user = User.find(params[:id])
 
     respond_to do |format|
-      if @user.update_attributes(params[:user])
+      if @user.update_attributes(user_params)
         format.html { redirect_to(@user, :notice => 'User was successfully updated.') }
         format.xml  { head :ok }
       else
         format.html { render "edit" }
         format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
       end
     end
   end
+
+  private
+
+    def user_params
+      params.require(:user).permit!
+    end
 end