Add strong parameters to orders_controller.rb

app/controllers/spree/admin/orders_controller.rb

@@ -44,7 +44,7 @@ module Spree
       end
 
       def update
-        unless @order.update_attributes(params[:order]) && @order.line_items.present?
+        unless @order.update_attributes(order_params) && @order.line_items.present?
           if @order.line_items.empty?
             @order.errors.add(:line_items, Spree.t('errors.messages.blank'))
           end
@@ -108,6 +108,10 @@ module Spree
 
       private
 
+      def order_params
+        params.require(:order).permit(:distributor_id, :order_cycle_id)
+      end
+
       def load_order
         @order = Order.find_by_number!(params[:id], include: :adjustments) if params[:id]
         authorize! action, @order