Rails upgrades

app/controllers/cmtool/application_controller.rb

@@ -1,6 +1,7 @@
 module Cmtool
   class ApplicationController < ::ApplicationController
     before_filter :authenticate_user!, :authorize_user, :check_environment, :set_locale
+    layout 'cmtool/application'
 
     private
 

app/controllers/cmtool/pages_controller.rb

@@ -41,7 +41,7 @@ module Cmtool
     # POST /pages
     # POST /pages.xml
     def create
-      @page = ::Page.new(params[:page])
+      @page = ::Page.new(page_params)
 
       respond_to do |format|
         if @page.save
@@ -60,7 +60,7 @@ module Cmtool
       @page = ::Page.find(params[:id])
 
       respond_to do |format|
-        if @page.update_attributes(params[:page])
+        if @page.update_attributes(page_params)
           format.html { redirect_to(cmtool.pages_path, :notice => I18n.t('cmtool.action.update.successful', :model => ::Page.model_name.human)) }
           format.xml  { head :ok }
         else
@@ -96,6 +96,11 @@ module Cmtool
 
     end
 
+    private
+
+    def page_params
+      params.require(:page).permit!
+    end
 
   end
 end

app/controllers/cmtool/users_controller.rb

@@ -19,7 +19,7 @@ module Cmtool
     end
 
     def create
-      @user = ::User.new(params[:user])
+      @user = ::User.new(user_params)
       if @user.save
         redirect_to cmtool.users_path, :notice => I18n.t('cmtool.action.create.successful', :model => ::User.model_name.human)
       else
@@ -28,7 +28,7 @@ module Cmtool
     end
 
     def update
-      user = params[:user]
+      user = user_params
       unless user['password'].present?
         user.delete('password')
         user.delete('password_confirmation')
@@ -50,5 +50,11 @@ module Cmtool
       @user.destroy
       redirect_to cmtool.users_path, :notice => I18n.t('cmtool.action.destroy.successful', :model => ::User.model_name.human)
     end
+
+    private
+
+    def user_params
+      params.require(:user).permit!
+    end
   end
 end