The pull request with all the code.

Using a before_action to dry up the finding of the object instance is the convention in Rails 4 with strong params. I agree he shouldn't be using it for :destroy since a User should only be able to destroy their own Ratings as you previously mentioned; however, there is nothing specifically wrong with what he did here.