[security] restrict allowed keys when creating/updating credits

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Next release
 - Fix a security issue: possible SQL injection when dropping the database
+- Fix a security issue: restrict allowed keys when creating/updating credits
 
 ## v4.7.1 2021 February 24
 - Fix a security issue: updated axios to 0.21.1 to fix [CVE-2020-28168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28168)

app/controllers/api/credits_controller.rb

@@ -47,6 +47,6 @@ class API::CreditsController < API::ApiController
   end
 
   def credit_params
-    params.require(:credit).permit!
+    params.require(:credit).permit(:creditable_id, :creditable_type, :plan_id, :hours)
   end
 end