Permit :admin in params only for admins

1 files changed, 3 insertions, 1 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 98fd534..f01691f 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -55,7 +55,9 @@ class UsersController < ApplicationController
   private
 
     def user_params
-      params.fetch(:user, {}).permit(:login, :email, :password, :password_confirmation, :admin)
+      allowed = [:login, :email, :password, :password_confirmation]
+      allowed << :admin if current_user.admin?
+      params.fetch(:user, {}).permit(allowed)
     end
 
     def find_user