Be stricter about the params we allow mass updates on

app/controllers/case_logs_controller.rb

@@ -90,6 +90,6 @@ private
   def create_params
     return {} unless params[:case_log]
 
-    params.require(:case_log).permit(CaseLog.new.attributes.keys)
+    params.require(:case_log).permit(CaseLog.editable_fields)
   end
 end

app/models/case_log.rb

@@ -47,4 +47,8 @@ class CaseLog < ApplicationRecord
     mandatory_fields = attributes.except(*AUTOGENERATED_FIELDS)
     mandatory_fields.none? { |_key, val| val.nil? }
   end
+
+  def self.editable_fields
+    attribute_names - AUTOGENERATED_FIELDS
+  end
 end