use strong params instead of attr_protected in member

app/models/member.rb

@@ -34,8 +34,6 @@ class Member < ActiveRecord::Base
   has_many :roles, :through => :member_roles
   belongs_to :project
 
-  attr_protected :project_id, :user_id, :role_ids
-
   validates_presence_of :principal, :project
   validates_uniqueness_of :user_id, :scope => :project_id
 

app/models/permitted_params.rb

@@ -116,6 +116,10 @@ class PermittedParams < Struct.new(:params, :user)
     permitted_params
   end
 
+  def member
+    params.require(:member).permit(*self.class.permitted_attributes[:member])
+  end
+
   def planning_element_type
     params.require(:planning_element_type).permit(*self.class.permitted_attributes[:planning_element_type])
   end
@@ -274,6 +278,8 @@ class PermittedParams < Struct.new(:params, :user)
         :membership => [
           :project_id,
           :role_ids => []]],
+      :member => [
+        :role_ids],
       :new_work_package => [
         :subject,
         :description,