feat(payments): add strong params

app/controllers/nonprofits/payments_controller.rb

@@ -45,7 +45,7 @@ module Nonprofits
 
     def update
       @payment = current_nonprofit.payments.find(params[:id])
-      @payment.update_attributes(params[:payment])
+      @payment.update_attributes(payment_params)
       json_saved @payment
     end
 
@@ -76,5 +76,11 @@ module Nonprofits
       PaymentMailer.resend_admin_receipt(params[:id], current_user.id)
       render json: {}
     end
+
+    private
+
+    def payment_params
+      params.require(:payment).permit(:towards, :gross_amount, :refund_total, :fee_total, :kind, :date)
+    end
   end # class PaymentsController
 end # module Nonprofits

app/models/payment_import.rb

@@ -2,7 +2,8 @@
 
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class PaymentImport < ApplicationRecord
-  # attr_accessible :nonprofit, :user
+  # :nonprofit,
+  # :user
   has_and_belongs_to_many :donations
   belongs_to :nonprofit
   belongs_to :user