2 files changed, 19 insertions, 7 deletions
diff --git a/guides/code/getting_started/app/controllers/comments_controller.rb b/guides/code/getting_started/app/controllers/comments_controller.rb
index 0082e9c8ec..b2d9bcdf7f 100644
--- a/guides/code/getting_started/app/controllers/comments_controller.rb
+++ b/guides/code/getting_started/app/controllers/comments_controller.rb
@@ -1,10 +1,10 @@
 class CommentsController < ApplicationController
 
-  http_basic_authenticate_with name: "dhh", password: "secret", only: :destroy
-  
+  http_basic_authenticate_with name: "dhh", password: "secret", only: :destroy
+
   def create
     @post = Post.find(params[:post_id])
-    @comment = @post.comments.create(params[:comment].permit(:commenter, :body))
+    @comment = @post.comments.create(comment_params)
     redirect_to post_path(@post)
   end
 
@@ -14,4 +14,10 @@ class CommentsController < ApplicationController
     @comment.destroy
     redirect_to post_path(@post)
   end
+
+  private
+
+    def comment_params
+      params.require(:comment).permit(:commenter, :body)
+    end
 end
diff --git a/guides/code/getting_started/app/controllers/posts_controller.rb b/guides/code/getting_started/app/controllers/posts_controller.rb
index 0398395200..02689ad67b 100644
--- a/guides/code/getting_started/app/controllers/posts_controller.rb
+++ b/guides/code/getting_started/app/controllers/posts_controller.rb
@@ -1,7 +1,7 @@
 class PostsController < ApplicationController
 
-  http_basic_authenticate_with name: "dhh", password: "secret", except: [:index, :show]
-  
+  http_basic_authenticate_with name: "dhh", password: "secret", except: [:index, :show]
+
   def index
     @posts = Post.all
   end
@@ -17,7 +17,7 @@ class PostsController < ApplicationController
   def update
     @post = Post.find(params[:id])
 
-    if @post.update(params[:post].permit(:title, :text))
+    if @post.update(post_params)
       redirect_to action: :show, id: @post.id
     else
       render 'edit'
@@ -29,7 +29,7 @@ class PostsController < ApplicationController
   end
 
   def create
-    @post = Post.new(params[:post].permit(:title, :text))
+    @post = Post.new(post_params)
 
     if @post.save
       redirect_to action: :show, id: @post.id
@@ -44,4 +44,10 @@ class PostsController < ApplicationController
 
     redirect_to action: :index
   end
+
+  private
+
+    def post_params
+      params.require(:post).permit(:title, :text)
+    end
 end