Making a user an admin user through a button without having the attribute accessible in Rails
===

From what I understand it would create a security flaw if I were to let my admin boolean in my users model be listed in attr_accessible. However I want a link on my show page that lets existing admin users grant admin privileges to other users. I was wondering how to go about doing this? My code in my show view for a user at the moment includes:

      <% if current_user.admin? && @user.admin == false %>
        <%= link_to "Make Administrator", '#', 
        data: { confirm: "Make this user an admin?" }, class: "btn btn-large btn-primary" %>
      <% elsif current_user.admin? && @user.admin%>
        <%= link_to "Remove Administrator", '#', class: "btn btn-large btn-danger" %>
      <% end %>

I'm not entirely sure what to put instead of the '#'? @user.toggle!(:admin) doesn't seem to work so any pointers would be appreciated. Thank you in advance!

