feat(ticket_levels): add strong params

app/controllers/ticket_levels_controller.rb

@@ -16,12 +16,12 @@ class TicketLevelsController < ApplicationController
   end
 
   def create
-    ticket_level = current_event.ticket_levels.create params[:ticket_level]
+    ticket_level = current_event.ticket_levels.create ticket_level_params
     json_saved ticket_level, 'Ticket level created!'
   end
 
   def update
-    current_ticket_level.update_attributes params[:ticket_level]
+    current_ticket_level.update_attributes ticket_level_params
     json_saved current_ticket_level, 'Ticket level updated'
   end
 
@@ -42,4 +42,8 @@ class TicketLevelsController < ApplicationController
   def current_ticket_level
     @ticket_level ||= current_event.ticket_levels.find params[:id]
   end
+
+  def ticket_level_params
+    params.require(:ticket_level).permit(:amount, :amount_dollars, :name, :description, :quantity, :deleted, :event_id, :admin_only, :limit, :order)
+  end
 end

app/models/ticket_level.rb

@@ -2,18 +2,16 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TicketLevel < ApplicationRecord
-  # TODO
-  # attr_accessible \
-  #   :amount, #integer
-  #   :amount_dollars, #accessor, string
-  #   :name, #string
-  #   :description, #text
-  #   :quantity, #integer
-  #   :deleted, #bool for soft delete
-  #   :event_id,
-  #   :admin_only, #bool, only admins can create tickets for this level
-  #   :limit, #int: for limiting the number of tickets to be sold
-  #   :order #int: order in which to be displayed
+  # :amount, #integer
+  # :amount_dollars, #accessor, string
+  # :name, #string
+  # :description, #text
+  # :quantity, #integer
+  # :deleted, #bool for soft delete
+  # :event_id,
+  # :admin_only, #bool, only admins can create tickets for this level
+  # :limit, #int: for limiting the number of tickets to be sold
+  # :order #int: order in which to be displayed
 
   attr_accessor :amount_dollars