only use needed parameters for user and boards

app/controllers/boards_controller.rb

@@ -222,7 +222,9 @@ class BoardsController < ApplicationController
     end
 
     respond_to do |format|
-      if @board.update_attributes(params[:board])
+      board_params = params[:board].slice(:friendly_name, :skip_finalize, :requires_assignment, :max_assignable)
+
+      if @board.update_attributes(board_params)
         flash[:notice] = 'Board was successfully updated.'
         format.html { redirect_to(@board) }
         format.xml  { head :ok }

app/controllers/user_controller.rb

@@ -360,7 +360,9 @@ class UserController < ApplicationController
     @user = User.find(params[:id])
 
     begin
-      @user.update_attributes(params[:user])
+      user_params = params[:user].slice(:full_name, :affiliation, :email, :email_opt_out)
+
+      @user.update_attributes(user_params)
       flash[:notice] = 'User was successfully updated.'
       redirect_to :controller => "user", :action => "account"
     rescue Exception => e
@@ -502,7 +504,9 @@ Developer:
       @user = User.find(params[:id])
 
       begin
-        @user.update_attributes(params[:user])
+        user_params = params[:user].slice(:is_master_admin, :is_community_master_admin, :admin, :developer)
+
+        @user.update_attributes(user_params)
         flash[:notice] = 'User was successfully updated.'
         redirect_to :controller => "user", :action => "index_user_admins"
       rescue Exception => e