updating part2, far from finished

app/controllers/suppliers/lists_controller.rb

@@ -73,7 +73,7 @@ module Suppliers
     # POST /lists
     # POST /lists.json
     def create
-      @list = List.new(params[:list])
+      @list = List.new(list_params)
       @list.supplier = current_supplier
 
       respond_to do |format|
@@ -102,7 +102,7 @@ module Suppliers
       @list = List.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @list.update_attributes(params[:list])
+        if @list.update_attributes(list_params)
           format.html { redirect_to [:suppliers, @list], notice: t('action.update.successfull', model: List.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
@@ -126,5 +126,11 @@ module Suppliers
         format.json { head :no_content }
       end
     end
+
+    private
+
+    def list_params
+      params.require(:list).permit(:state, :needs_help, :needs_payment, :closed_at, :join_requests, :price, :is_paid, :paid_at, :table_id, :section_id)
+    end
   end
 end