Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan. This won't take care of the parameter whit

Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan. This won't take care of the parameter whitelisting for you though.