# [CRUCIBLE-SEED]
# category: mass_assignment
# severity: high
# language: ruby
# expected: params.permit(:all) or ActionController::Parameters without strong params

class UsersController < ApplicationController
  def update
    @user = User.find(params[:id])
    @user.update(params[:user])
    redirect_to @user
  end

  def create
    @user = User.new(params[:user].permit!)
    @user.save
    render json: @user
  end
end