diff --git a/app/controllers/admin/groups_controller.rb b/app/controllers/admin/groups_controller.rb
index 1a523d081dd88a6c557b8e012638a12fb6b370a5..0388997ec69a3945711d41e53615703de8862273 100644
--- a/app/controllers/admin/groups_controller.rb
+++ b/app/controllers/admin/groups_controller.rb
@@ -20,7 +20,7 @@ class Admin::GroupsController < Admin::ApplicationController
   end
 
   def create
-    @group = Group.new(params[:group])
+    @group = Group.new(group_params)
     @group.path = @group.name.dup.parameterize if @group.name
 
     if @group.save
@@ -32,7 +32,7 @@ class Admin::GroupsController < Admin::ApplicationController
   end
 
   def update
-    if @group.update_attributes(params[:group])
+    if @group.update_attributes(group_params)
       redirect_to [:admin, @group], notice: 'Group was successfully updated.'
     else
       render "edit"
@@ -56,4 +56,8 @@ class Admin::GroupsController < Admin::ApplicationController
   def group
     @group = Group.find_by(path: params[:id])
   end
+
+  def group_params
+    params.require(:group).permit(:name, :description, :path, :avatar)
+  end
 end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index a2629c51384ee43d3eb7197660dc69848bd31643..ddde90d3ee0c10f9dedd762801c3b92549fb4005 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -22,7 +22,7 @@ class GroupsController < ApplicationController
   end
 
   def create
-    @group = Group.new(params[:group])
+    @group = Group.new(group_params)
     @group.path = @group.name.dup.parameterize if @group.name
 
     if @group.save
@@ -84,7 +84,7 @@ class GroupsController < ApplicationController
   end
 
   def update
-    if @group.update_attributes(params[:group])
+    if @group.update_attributes(group_params)
       redirect_to edit_group_path(@group), notice: 'Group was successfully updated.'
     else
       render action: "edit"
@@ -159,4 +159,8 @@ class GroupsController < ApplicationController
     params[:state] = 'opened' if params[:state].blank?
     params[:group_id] = @group.id
   end
+
+  def group_params
+    params.require(:group).permit(:name, :description, :path, :avatar)
+  end
 end
diff --git a/app/models/event.rb b/app/models/event.rb
index 487ea7666e5760f6f8d5ac0a1a11acbcf538a6cf..c7e93825f976d04956029f6a5c6640e6baec6044 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -15,9 +15,6 @@
 #
 
 class Event < ActiveRecord::Base
-  #attr_accessible :project, :action, :data, :author_id, :project_id,
-                  #:target_id, :target_type
-
   default_scope { where.not(author_id: nil) }
 
   CREATED   = 1
diff --git a/app/models/group.rb b/app/models/group.rb
index 671b5611a71abb1e909dacda3bc9327657bda0b4..3a5c5e113547798b4968c39275340f3d652439e9 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -20,8 +20,6 @@ class Group < Namespace
   has_many :users_groups, dependent: :destroy
   has_many :users, through: :users_groups
 
-  #attr_accessible :avatar
-
   validate :avatar_type, if: ->(user) { user.avatar_changed? }
   validates :avatar, file_size: { maximum: 100.kilobytes.to_i }
 
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 524fd9e0c4cf6c782380805fcb659832aa371d4c..cd58710825d45a2c69c3ae72bea046ec36bb9683 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -16,8 +16,6 @@
 class Namespace < ActiveRecord::Base
   include Gitlab::ShellAdapter
 
-  #attr_accessible :name, :description, :path
-
   has_many :projects, dependent: :destroy
   belongs_to :owner, class_name: "User"