updating part2, far from finished

app/controllers/suppliers/tables_controller.rb

@@ -43,7 +43,7 @@ module Suppliers
     # POST /tables
     # POST /tables.json
     def create
-      @table = Table.new(params[:table])
+      @table = Table.new(table_params)
       @table.supplier = current_supplier
 
       respond_to do |format|
@@ -63,8 +63,8 @@ module Suppliers
       @table= Table.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @table.update_attributes(params[:table])
-          format.html { redirect_to [:suppliers, @table], notice: t('action.update.successfull', model: Table.model_name.human) }
+        if @table.update_attributes(table_params)
+          format.html { redirect_to [:suppliers, @table.section || @table], notice: t('action.update.successfull', model: Table.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
         else
@@ -92,5 +92,11 @@ module Suppliers
       @tables.select!{|t| t.section_id == params[:section_id]} if params[:section_id].present?
       render layout: 'qr_sheet'
     end
+
+    private
+
+    def table_params
+      params.require(:table).permit(:number, :section_id, :position_x, :position_y)
+    end
   end
 end