updating part2, far from finished

app/controllers/suppliers/lists_controller.rb

@@ -73,7 +73,7 @@ module Suppliers
     # POST /lists
     # POST /lists.json
     def create
-      @list = List.new(params[:list])
+      @list = List.new(list_params)
       @list.supplier = current_supplier
 
       respond_to do |format|
@@ -102,7 +102,7 @@ module Suppliers
       @list = List.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @list.update_attributes(params[:list])
+        if @list.update_attributes(list_params)
           format.html { redirect_to [:suppliers, @list], notice: t('action.update.successfull', model: List.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
@@ -126,5 +126,11 @@ module Suppliers
         format.json { head :no_content }
       end
     end
+
+    private
+
+    def list_params
+      params.require(:list).permit(:state, :needs_help, :needs_payment, :closed_at, :join_requests, :price, :is_paid, :paid_at, :table_id, :section_id)
+    end
   end
 end

app/controllers/suppliers/product_categories_controller.rb

@@ -42,7 +42,7 @@ module Suppliers
     # POST /product_categories
     # POST /product_categories.json
     def create
-      @product_category = ProductCategory.new(params[:product_category])
+      @product_category = ProductCategory.new(product_category_params)
       @product_category.supplier = current_supplier
 
       respond_to do |format|
@@ -62,7 +62,7 @@ module Suppliers
       @product_category = ProductCategory.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @product_category.update_attributes(params[:product_category])
+        if @product_category.update_attributes(product_category_params)
           format.html { redirect_to [:suppliers, :product_categories], notice: t('action.update.successfull', model: ProductCategory.model_name.human) }
           format.json { head :no_content }
         else
@@ -92,5 +92,11 @@ module Suppliers
       CouchPotato.database.couchrest_database.bulk_save(@product_categories)
       render nothing: true
     end
+
+    private
+
+    def product_category_params
+      params.require(:product_category).permit(:name, :start_from, :end_on, :full_day, product_ids: [], week_days: [])
+    end
   end
 end

app/controllers/suppliers/products_controller.rb

@@ -43,12 +43,12 @@ module Suppliers
     # POST /products
     # POST /products.json
     def create
-      @product = Product.new(params[:product])
+      @product = Product.new(product_params)
       @product.supplier = current_supplier
 
       respond_to do |format|
         if @product.save
-          format.html { redirect_to [:suppliers, @product], notice: t('action.create.successfull', model: Product.model_name.human) }
+          format.html { redirect_to [:suppliers, :products], notice: t('action.create.successfull', model: Product.model_name.human) }
           format.json { render json: @product, status: :created, location: @product }
         else
           format.html { render action: "new" }
@@ -63,8 +63,8 @@ module Suppliers
       @product = Product.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @product.update_attributes(params[:product])
-          format.html { redirect_to [:suppliers, @product], notice: t('action.update.successfull', model: Product.model_name.human) }
+        if @product.update_attributes(product_params)
+          format.html { redirect_to [:suppliers, :products], notice: t('action.update.successfull', model: Product.model_name.human) }
           format.json { head :no_content }
         else
           format.html { render action: "edit" }
@@ -90,5 +90,11 @@ module Suppliers
       product_categories = ProductCategory.for_supplier_in_time(current_supplier, @time)
       render json: {categories: product_categories.map(&:to_client_format).select(&:present?)}
     end
+
+    private
+
+    def product_params
+      params.require(:product).permit(:name, :code, :price, product_category_ids: [])
+    end
   end
 end

app/controllers/suppliers/sections_controller.rb

@@ -54,7 +54,7 @@ module Suppliers
     # POST /sections
     # POST /sections.json
     def create
-      @section = Section.new(params[:section])
+      @section = Section.new(section_params)
       @section.supplier = current_supplier
 
       respond_to do |format|
@@ -74,7 +74,7 @@ module Suppliers
       @section = Section.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @section.update_attributes(params[:section])
+        if @section.update_attributes(section_params)
           format.html { redirect_to [:suppliers, @section], notice: t('action.update.successfull', model: Section.model_name.human) }
           format.json { head :no_content }
         else
@@ -157,5 +157,11 @@ module Suppliers
       @orders = @list ? @list.active_orders : []
       render layout: false
     end
+
+    private
+
+    def section_params
+      params.require(:section).permit(:title, :path, :width, :height)
+    end
   end
 end

app/controllers/suppliers/tables_controller.rb

@@ -43,7 +43,7 @@ module Suppliers
     # POST /tables
     # POST /tables.json
     def create
-      @table = Table.new(params[:table])
+      @table = Table.new(table_params)
       @table.supplier = current_supplier
 
       respond_to do |format|
@@ -63,8 +63,8 @@ module Suppliers
       @table= Table.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @table.update_attributes(params[:table])
-          format.html { redirect_to [:suppliers, @table], notice: t('action.update.successfull', model: Table.model_name.human) }
+        if @table.update_attributes(table_params)
+          format.html { redirect_to [:suppliers, @table.section || @table], notice: t('action.update.successfull', model: Table.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
         else
@@ -92,5 +92,11 @@ module Suppliers
       @tables.select!{|t| t.section_id == params[:section_id]} if params[:section_id].present?
       render layout: 'qr_sheet'
     end
+
+    private
+
+    def table_params
+      params.require(:table).permit(:number, :section_id, :position_x, :position_y)
+    end
   end
 end