title: Strong Parameters and Find in Rails 4
body: <p>I am having trouble with strong parameters in my custom controller. I understand how to use strong parameters in a new or update action. However, I can't seem to figure out if this is an unsecure use of the params[]  hash or not in my custom action.</p>
  
  <p>My view redirects to a controller with an order id and an operation number:</p>
  
  <pre><code>link_to 'Confirm', confirmpayment_confirm_path(order: order, operacion: order.operacion), :data =&gt; { confirm: 'Are you sure?' }
  </code></pre>
  
  <p>My confirmpayment controller is as follows:</p>
  
  <pre><code>class ConfirmpaymentController &lt; ApplicationController
    before_action :authenticate_user!
  
    def lookup
      authorize! :lookup, :confirmpayment
      @orders=Order.where(:status =&gt; 'PENDING')
    end
  
    def confirm
      authorize! :confirm, :confirmpayment
      @order=Order.find(params[:order])
      @order.payment_id = params[:operacion]
      @order.confirm_payment_date = DateTime.now()
      @order.save
    end
  
    def order_params
      params.require(:order).permit(:order, :operacion) 
    end
  
  end  
  </code></pre>
  
  <p>The question is:</p>
  
  <p>I am not using <code>order_params</code> anywhere in my confirm action, since this is not a new order. I am using the parameter to find the proper order and confirm it. Is this secure? Or am I missing something?</p>