Strong parameters in controller for generated refinery forms

core/lib/generators/refinery/form/templates/app/controllers/refinery/namespace/plural_name_controller.rb.erb

@@ -18,7 +18,7 @@ module Refinery
       end
 
       def create
-        @<%= singular_name %> = <%= class_name %>.new(params[:<%= singular_name %>])
+        @<%= singular_name %> = <%= class_name %>.new(<%= singular_name %>_params)
 
         if @<%= singular_name %>.save
           begin
@@ -45,6 +45,10 @@ module Refinery
 
     protected
 
+      def <%= singular_name %>_params
+        params.require(:<%= singular_name %>).permit(<%= attributes.map { |a| ":" << a.name }.join(", ") %>)
+      end
+
       def find_page
         @page = Refinery::Page.where(link_url: "/<%= plural_name %>/new").
                                includes(:parts).first_or_create!