disallow to update attendance or comment on activity

src/resources/activity/activityControllers.js

@@ -185,7 +185,7 @@ exports.default.updateOne = async (req, res) => {
   try {
     const activity = await Activity.findOneAndUpdate(
       { _id: req.params.id },
-      req.body,
+      omit(req.body, ['attendance', 'comment']),
       { new: true }
     )
       .populate({