check that `changes` param is present

app/controllers/admin/groups_controller.rb

@@ -23,7 +23,7 @@ class Admin::GroupsController < Admin::AdminController
   def update_patch(group)
     raise Discourse::InvalidAccess.new("automatic groups do not permit membership changes") if group.automatic
 
-    actions = params[:changes]
+    if actions = params[:changes]
       Array(actions[:add]).each do |username|
         if user = User.find_by_username(username)
           group.add(user)
@@ -34,6 +34,7 @@ class Admin::GroupsController < Admin::AdminController
           group.remove(user)
         end
       end
+    end
 
     render json: success_json
   end