Use except to avoid mass assignment

jonallured · Mar 6, 2024 · da9763a · da9763a
1 parent d9d67b1
commit da9763a
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app/api/using_grape/artworks_endpoint.rb b/app/api/using_grape/artworks_endpoint.rb
@@ -12,7 +12,7 @@ class ArtworksEndpoint < Grape::API
       end
 
       post do
-        artwork = Artwork.new(params)
+        artwork = Artwork.new(params.except(:featured))
         if artwork.save
           artwork
         else
@@ -23,7 +23,7 @@ class ArtworksEndpoint < Grape::API
 
       put ":id" do
         artwork = Artwork.find(params[:id])
-        if artwork.update(params)
+        if artwork.update(params.except(:featured))
           artwork
         else
           errors = {errors: artwork.errors.full_messages.to_sentence}