dmails_controller.rb: convert to strong params.

app/controllers/dmails_controller.rb

@@ -9,7 +9,7 @@ class DmailsController < ApplicationController
       check_privilege(parent)
       @dmail = parent.build_response(:forward => params[:forward])
     else
-      @dmail = Dmail.new(params[:dmail])
+      @dmail = Dmail.new(create_params)
     end
 
     respond_with(@dmail)
@@ -39,7 +39,7 @@ class DmailsController < ApplicationController
   end
 
   def create
-    @dmail = Dmail.create_split(params[:dmail].merge(:creator_ip_addr => request.remote_ip))
+    @dmail = Dmail.create_split(create_params)
     respond_with(@dmail)
   end
 
@@ -66,4 +66,8 @@ private
       raise User::PrivilegeError
     end
   end
+
+  def create_params
+    params.fetch(:dmail, {}).permit(:title, :body, :to_name, :to_id)
+  end
 end