Add strong params to refunds_controller

app/controllers/nonprofits/refunds_controller.rb

@@ -9,14 +9,20 @@ module Nonprofits
 
     # post /charges/:charge_id/refunds
     def create
-      charge = Qx.select('*').from('charges').where(id: params[:charge_id]).execute.first
+      charge = Qx.select('*').from('charges').where(id: charge_params[:charge_id]).execute.first
       params[:refund][:user_id] = current_user.id
-      render_json { InsertRefunds.with_stripe(charge, params['refund']) }
+      render_json { InsertRefunds.with_stripe(charge, charge_params['refund']) }
     end
 
     def index
       charge = current_nonprofit.charges.find(params[:charge_id])
       @refunds = charge.refunds
     end
+
+private
+
+    def charge_params
+      params.require(:charge_id, refund: [:amount])
+    end
   end
 end