added attr_protected calls to protect mass assignment of :project_id through a view

lib/report.rb

@@ -13,6 +13,8 @@ class Report < ActiveRecord::Base
 
   before_save :serialize
   serialize :serialized, Hash
+  
+  attr_protected :project_id #, :user_id
 
   self.abstract_class = true # lets have subclasses have their own SQL tables