From 641e67dc2e98e93b2123dd0dcbb93cd7bd9f21b8 Mon Sep 17 00:00:00 2001 From: Rosa Gutierrez Date: Fri, 19 Dec 2025 22:29:11 +0100 Subject: [PATCH] Remove `status` from allowed parameters in `CardsController#update` We don't allow changing the status via this action, and it's confusing and can lead to cases where someone can set someone's else card as draft, effectively hiding it. --- app/controllers/cards_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/cards_controller.rb b/app/controllers/cards_controller.rb index bfdc1ee2e..daf22a5bc 100644 --- a/app/controllers/cards_controller.rb +++ b/app/controllers/cards_controller.rb @@ -61,6 +61,6 @@ class CardsController < ApplicationController end def card_params - params.expect(card: [ :status, :title, :description, :image, :created_at, :last_active_at ]) + params.expect(card: [ :title, :description, :image, :created_at, :last_active_at ]) end end