This is too permissive - it would allow someone to change any attribute on the attachments, including stuff like `attachable_type` and `attachable_id`. See `attachment_params` for how the strong_parameters gem is used to limit the attributes to a predefined whitelist of permitted parameters. Alternatively, we are only actually interested in updating attachment titles so maybe this should simply be changed to `if !attachment.update_attribute(:title, attributes[:title])`.