A user's public_key is the only attribute they should be able to update via API.

1 files changed, 2 insertions, 1 deletions

diff --git a/users/app/controllers/v1/users_controller.rb b/users/app/controllers/v1/users_controller.rb
index e8e8f00..9b5997d 100644
--- a/users/app/controllers/v1/users_controller.rb
+++ b/users/app/controllers/v1/users_controller.rb
@@ -12,8 +12,9 @@ module V1
     end
 
     def update
+      # For now, only allow public key to be updated via the API. Eventually we might want to store in a config what attributes can be updated via the API.
       @user = User.find_by_param(params[:id])
-      @user.update_attributes(params[:user])
+      @user.update_attributes(:public_key => params[:user][:public_key])
       respond_with @user
     end