class UsersController < ApplicationController
  before_action :authenticate_user!, PQUserFilter

  def index
    @users = User.active_list
                 .order(deleted: :asc)
                 .order(Arel.sql('lower(name)'))
    update_page_title('Users')
  end

  def edit
    @user = User.find(params[:id])
    update_page_title('Edit user')
  end

  def show
    @user = User.find(params[:id])
    update_page_title('User details')
  end

  def update
    @user = User.find(params[:id])
    flash[:success] = 'User updated' if @user.update(user_params)
    redirect_to users_path
  end

  protected

  def user_params
    params.require(:user).permit(:email, :admin, :name, :roles, :deleted)
  end
end

class UsersController < ApplicationController
  before_action :authenticate_user!, PQUserFilter

  def index
    @users = User.active_list
                 .order(deleted: :asc)
                 .order(Arel.sql('lower(name)'))
    update_page_title('Users')
  end

  def edit
    @user = User.find(params[:id])
    update_page_title('Edit user')
  end

  def show
    @user = User.find(params[:id])
    update_page_title('User details')
  end

  def update
    @user = User.find(params[:id])
    flash[:success] = 'User updated' if @user.update(user_params)
    redirect_to users_path
  end

  protected

  def user_params
    params.require(:user).permit(:email, :name, :roles, :deleted)
  end
end

Remove :admin key in param to stop Brakeman warning
Remove :admin key in param to stop Brakeman warning

The issue that brakeman was complaining about is that admin was being allowed in .permit in the users_controller.rb.

I think this was a mistake in that these params are only used on to update a user and the form that controls this has no :admin value to return. A completely filled in form has the following keys returned:

"user"=>{ "name"=>"New OldName",
                 "email"=>"admin@something.com",
                 "roles"=>"PQUSER",
                 "deleted"=>"0"}

Similarly the models in the app have no 'admin' flag at all.

I think this was just an oversight or left over from an earlier iteration of the page.

I have removed the :admin key here, and this brakeman warning no longer occurs
