Sounds logical.  I'll check out #2540

2013/3/7 Ryan Bigg <notifications@github.com>

> In api/app/controllers/spree/api/products_controller.rb:
>
> > @@ -30,7 +30,10 @@ def create
> >        def update
> >          authorize! :update, Product
> >          @product = find_product(params[:id])
> > -        if @product.update_attributes(params[:product])
> > +
> > +				product_params = params[:product].except(:option_types,:variants,:product_properties,:count_on_hand)
>
> I really think that we shouldn't have this stuff in the controllers *just
> yet*. Rather, we should wait until the work on #2540<https://github.com/spree/spree/issues/2540>is complete and then use that. I like the idea of excluding parameters now,
> but I would rather do it once and do it correctly with strong_parameters,
> than do it once here and then do it *again* with strong parameters later
> on.
>
> There's other cases in the API where you would need to exclude parameters
> too.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/spree/spree/pull/2658/files#r3272018>
> .
>