Add cr remarks

3 files changed, 5 insertions, 5 deletions

diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index b419d669544..f76e6663995 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -328,9 +328,9 @@ class ProjectsController < Projects::ApplicationController
   end
   # rubocop: enable CodeReuse/ActiveRecord
 
-  def project_params(attributes: project_params_attributes)
+  def project_params(attributes: [])
     params.require(:project)
-      .permit(attributes)
+      .permit(project_params_attributes + attributes)
   end
 
   def project_params_attributes
@@ -375,7 +375,7 @@ class ProjectsController < Projects::ApplicationController
   end
 
   def project_params_create_attributes
-    project_params_attributes << :namespace_id
+    [:namespace_id]
   end
 
   def custom_import_params
diff --git a/changelogs/unreleased/security-mass-assignment-on-project-update.yml b/changelogs/unreleased/security-mass-assignment-on-project-update.yml
index 8657dcdd135..93561cd91b3 100644
--- a/changelogs/unreleased/security-mass-assignment-on-project-update.yml
+++ b/changelogs/unreleased/security-mass-assignment-on-project-update.yml
@@ -1,5 +1,5 @@
 ---
-title: Disallow updating namespace during updating project
+title: Disallow updating namespace when updating a project
 merge_request:
 author:
 type: security
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 41380e79305..717675d1d30 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -383,7 +383,7 @@ describe ProjectsController do
               id: project.id,
               project: params
             }
-        end.not_to change {project.namespace}
+        end.not_to change {project.reload.namespace}
       end
 
       def update_project(**parameters)