diff --git a/Gemfile b/Gemfile index 7bc1d784..5381b55d 100644 --- a/Gemfile +++ b/Gemfile @@ -94,9 +94,6 @@ gem 'font-awesome-rails' # for Markdown in description gem 'redcarpet' -# FIXME: We should use http://weblog.rubyonrails.org/2012/3/21/strong-parameters/ -gem 'protected_attributes' - # as rdoc generator gem 'rdoc-generator-fivefish' diff --git a/Gemfile.lock b/Gemfile.lock index 5f533189..a63c84e4 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -287,8 +287,6 @@ GEM prawn_rails (0.0.11) prawn (>= 0.11.1) railties (>= 3.0.0) - protected_attributes (1.0.7) - activemodel (>= 4.0.1, < 5.0) pry (0.9.12.6) coderay (~> 1.0) method_source (~> 0.8) @@ -481,7 +479,6 @@ DEPENDENCIES piwik_analytics (~> 1.0.1) poltergeist prawn_rails - protected_attributes quiet_assets rails (~> 4.1) rails-observers diff --git a/app/controllers/admin/call_for_papers_controller.rb b/app/controllers/admin/call_for_papers_controller.rb index ae75dd9c..657c2134 100644 --- a/app/controllers/admin/call_for_papers_controller.rb +++ b/app/controllers/admin/call_for_papers_controller.rb @@ -26,12 +26,12 @@ module Admin def update authorize! :update, @conference.call_for_paper @cfp = @conference.call_for_paper - @cfp.assign_attributes(params[:call_for_paper]) + @cfp.assign_attributes(call_for_paper_params) send_mail_on_schedule_public = @cfp.notify_on_schedule_public? send_mail_on_cfp_dates_updated = @cfp.notify_on_cfp_date_update? - if @cfp.update_attributes(params[:call_for_paper]) + if @cfp.update_attributes(call_for_paper_params) Mailbot.delay.send_on_call_for_papers_dates_updated(@conference) if send_mail_on_cfp_dates_updated Mailbot.delay.send_on_schedule_public(@conference) if send_mail_on_schedule_public redirect_to(admin_conference_call_for_paper_path(@conference.short_title), @@ -54,7 +54,7 @@ module Admin private def call_for_paper_params - params[:call_for_paper] + params.require(:call_for_paper).permit(:start_date, :end_date, :schedule_changes, :rating, :schedule_public, :include_cfp_in_splash, :conference_id) end end end diff --git a/app/controllers/admin/campaigns_controller.rb b/app/controllers/admin/campaigns_controller.rb index 2f39958a..a7ace352 100644 --- a/app/controllers/admin/campaigns_controller.rb +++ b/app/controllers/admin/campaigns_controller.rb @@ -9,7 +9,7 @@ module Admin end def create - @campaign.attributes = params[:campaign] + @campaign.attributes = campaign_params if @conference.save flash[:notice] = 'Campaign successfully created.' @@ -25,7 +25,7 @@ module Admin def edit; end def update - if @campaign.update_attributes(params[:campaign]) + if @campaign.update_attributes(campaign_params) flash[:notice] = "Campaign '#{@campaign.name}' successfully updated." redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title)) else @@ -44,5 +44,11 @@ module Admin redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title)) end end + + private + + def campaign_params + params.require(:campaign).permit(:name, :utm_source, :utm_medium, :utm_term, :utm_content, :utm_campaign, :target_ids, :conference_id) + end end end diff --git a/app/controllers/admin/commercials_controller.rb b/app/controllers/admin/commercials_controller.rb index 59bfd459..3f734dac 100644 --- a/app/controllers/admin/commercials_controller.rb +++ b/app/controllers/admin/commercials_controller.rb @@ -45,8 +45,7 @@ module Admin private def commercial_params - #params.require(:commercial).permit(:commercial_id, :commercial_type) - params[:commercial] + params.require(:commercial).permit(:commercial_id, :commercial_type) end end end diff --git a/app/controllers/admin/conference_controller.rb b/app/controllers/admin/conference_controller.rb index 89ad9970..abaaae38 100644 --- a/app/controllers/admin/conference_controller.rb +++ b/app/controllers/admin/conference_controller.rb @@ -63,7 +63,7 @@ module Admin end def create - @conference = Conference.new(params[:conference]) + @conference = Conference.new(conference_params) if @conference.valid? @conference.save @@ -79,10 +79,10 @@ module Admin def update @conference = Conference.find_by(short_title: params[:id]) short_title = @conference.short_title - @conference.assign_attributes(params[:conference]) + @conference.assign_attributes(conference_params) send_mail_on_conf_update = @conference.notify_on_dates_changed? - if @conference.update_attributes(params[:conference]) + if @conference.update_attributes(conference_params) Mailbot.delay.conference_date_update_mail(@conference) if send_mail_on_conf_update redirect_to(edit_admin_conference_path(id: @conference.short_title), notice: 'Conference was successfully updated.') @@ -194,7 +194,21 @@ module Admin render 'roles', formats: [:js] end - protected + private + + def conference_params + params.require(:conference).permit(:title, :short_title, :description, :timezone, :html_export_path, + :start_date, :end_date, :rooms_attributes, :tracks_attributes, + :dietary_choices_attributes, :use_dietary_choices, + :tickets_attributes, :social_events_attributes, :event_types_attributes, + :logo, :questions_attributes, + :question_ids, :answers_attributes, :answer_ids, :difficulty_levels_attributes, + :use_difficulty_levels, :use_vpositions, :use_vdays, :vdays_attributes, + :vpositions_attributes, :use_volunteers, :color, + :sponsorship_levels_attributes, :sponsors_attributes, + :photos_attributes, :targets, :targets_attributes, + :campaigns, :campaigns_attributes) + end def get_users(role_name) @role_users = {} diff --git a/app/controllers/admin/contacts_controller.rb b/app/controllers/admin/contacts_controller.rb index a8cda01a..72ac0d42 100644 --- a/app/controllers/admin/contacts_controller.rb +++ b/app/controllers/admin/contacts_controller.rb @@ -22,8 +22,7 @@ module Admin # Only allow a trusted parameter "white list" through. def contact_params - # params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public) - params[:contact] + params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public, :sponsor_email) end end end diff --git a/app/controllers/admin/difficulty_levels_controller.rb b/app/controllers/admin/difficulty_levels_controller.rb index 8ee5edc1..2ebcb2e4 100644 --- a/app/controllers/admin/difficulty_levels_controller.rb +++ b/app/controllers/admin/difficulty_levels_controller.rb @@ -48,7 +48,7 @@ module Admin private def difficulty_level_params - params[:difficulty_level] + params.require(:difficulty_level).permit(:title, :description, :color, :conference_id) end end end diff --git a/app/controllers/admin/emails_controller.rb b/app/controllers/admin/emails_controller.rb index b0f0a26c..799918fa 100644 --- a/app/controllers/admin/emails_controller.rb +++ b/app/controllers/admin/emails_controller.rb @@ -4,7 +4,7 @@ module Admin load_and_authorize_resource class: EmailSettings def update - @conference.email_settings.update_attributes(params[:email_settings]) + @conference.email_settings.update_attributes(email_params) redirect_to(admin_conference_emails_path( @conference.short_title), notice: 'Settings have been successfully updated.') @@ -14,5 +14,18 @@ module Admin authorize! :index, @conference.email_settings @settings = @conference.email_settings end + + private + + def email_params + params.require(:email_settings).permit(:send_on_registration, :send_on_accepted, :send_on_rejected, :send_on_confirmed_without_registration, + :registration_subject, :accepted_subject, :rejected_subject, :confirmed_without_registration_subject, + :registration_body, :accepted_body, :rejected_body, :confirmed_without_registration_body, + :send_on_conference_dates_updated, :conference_dates_updated_subject, :conference_dates_updated_body, + :send_on_conference_registration_dates_updated, :conference_registration_dates_updated_subject, :conference_registration_dates_updated_body, + :send_on_venue_updated, :venue_updated_subject, :venue_updated_body, + :send_on_call_for_papers_dates_updated, :call_for_papers_dates_updated_subject, :call_for_papers_dates_updated_body, + :send_on_call_for_papers_schedule_public, :call_for_papers_schedule_public_subject, :call_for_papers_schedule_public_body) + end end end diff --git a/app/controllers/admin/event_types_controller.rb b/app/controllers/admin/event_types_controller.rb index 8f2cf042..38f0ed91 100644 --- a/app/controllers/admin/event_types_controller.rb +++ b/app/controllers/admin/event_types_controller.rb @@ -48,7 +48,7 @@ module Admin private def event_type_params - params[:event_type] + params.require(:event_type).permit(:title, :length, :minimum_abstract_length, :maximum_abstract_length, :color, :conference_id, :description) end end end diff --git a/app/controllers/admin/events_controller.rb b/app/controllers/admin/events_controller.rb index 2334531d..d25f610a 100644 --- a/app/controllers/admin/events_controller.rb +++ b/app/controllers/admin/events_controller.rb @@ -95,7 +95,7 @@ module Admin end def comment - comment = Comment.build_from(@event, current_user.id, params[:comment]) + comment = Comment.build_from(@event, current_user.id, comment_params) comment.save! if !params[:parent].nil? comment.move_to_child_of(params[:parent]) @@ -105,8 +105,7 @@ module Admin end def update - if @event.submitter.update_attributes(params[:user]) && - @event.update_attributes(params[:event]) + if @event.update_attributes(event_params) if request.xhr? render js: 'index' @@ -167,6 +166,20 @@ module Admin private + def event_params + params.require(:event).permit( + # Set also in proposals controller + :title, :subtitle, :event_type_id, :abstract, :description, :require_registration, :difficulty_level_id, + # Set only in admin/events controller + :track_id, :state, :language, :start_time, :is_highlight, + # Not used anymore? + :proposal_additional_speakers, :user, :users_attributes) + end + + def comment_params + params.require(:comment).permit(:commentable, :body, :user_id) + end + def get_event @event = @conference.events.find_by_id(params[:id]) if !@event diff --git a/app/controllers/admin/lodgings_controller.rb b/app/controllers/admin/lodgings_controller.rb index 9b4fabdb..000f0310 100644 --- a/app/controllers/admin/lodgings_controller.rb +++ b/app/controllers/admin/lodgings_controller.rb @@ -47,7 +47,7 @@ module Admin private def lodging_params - params[:lodging] + params.require(:lodging).permit(:name, :description, :photo, :website_link, :conference_id) end end end diff --git a/app/controllers/admin/questions_controller.rb b/app/controllers/admin/questions_controller.rb index b55ff496..590182c3 100644 --- a/app/controllers/admin/questions_controller.rb +++ b/app/controllers/admin/questions_controller.rb @@ -20,7 +20,7 @@ module Admin end def create - @question = @conference.questions.new(params[:question]) + @question = @conference.questions.new(question_params) @question.conference_id = @conference.id authorize! :create, @question @@ -47,7 +47,7 @@ module Admin # PUT questions/1 def update - if @question.update_attributes(params[:question]) + if @question.update_attributes(question_params) redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.") else redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed. #{@question.errors.full_messages.join('. ')}") @@ -57,7 +57,7 @@ module Admin # Update questions used for the conference def update_conference authorize! :update, Question.new(conference_id: @conference.id) - if @conference.update_attributes(params[:conference]) + if @conference.update_attributes(conference_params) redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.") else redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.") @@ -93,5 +93,15 @@ module Admin @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id) @questions_conference = @conference.questions end + + private + + def question_params + params.require(:question).permit(:title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id) + end + + def conference_params + params.require(:conference).permit(question_ids: []) + end end end diff --git a/app/controllers/admin/registration_periods_controller.rb b/app/controllers/admin/registration_periods_controller.rb index 935cc443..85a7eef4 100644 --- a/app/controllers/admin/registration_periods_controller.rb +++ b/app/controllers/admin/registration_periods_controller.rb @@ -8,7 +8,7 @@ module Admin end def create - @registration_period = @conference.build_registration_period(registration_period) + @registration_period = @conference.build_registration_period(registration_period_params) send_mail_on_reg_update = @conference.notify_on_registration_dates_changed? if @registration_period.save @@ -28,10 +28,10 @@ module Admin end def update - @registration_period.assign_attributes(registration_period) + @registration_period.assign_attributes(registration_period_params) send_mail_on_reg_update = @conference.notify_on_registration_dates_changed? - if @registration_period.update(registration_period) + if @registration_period.update(registration_period_params) Mailbot.delay.conference_registration_date_update_mail(@conference) if send_mail_on_reg_update redirect_to admin_conference_registration_period_path(@conference.short_title), notice: 'Registration Period successfully updated.' @@ -50,8 +50,8 @@ module Admin private - def registration_period - params[:registration_period] + def registration_period_params + params.require(:registration_period).permit(:start_date, :end_date) end end end diff --git a/app/controllers/admin/registrations_controller.rb b/app/controllers/admin/registrations_controller.rb index 70abe4a1..72021e80 100644 --- a/app/controllers/admin/registrations_controller.rb +++ b/app/controllers/admin/registrations_controller.rb @@ -45,22 +45,17 @@ module Admin end end - protected + private def set_user @user = User.find_by(id: @registration.user_id) end def registration_params - params.require(:registration). - permit( - :conference_id, :arrival, :departure, - :volunteer, - vchoice_ids: [], qanswer_ids: [], event_ids: [], - qanswers_attributes: [], - user_attributes: [ - :id, :name, :tshirt, :mobile, :volunteer_experience, :languages, - :nickname, :affiliation]) + params.require(:registration).permit(:user_id, :conference_id, :arrival, :departure, :attended, + :volunteer, :other_special_needs, + vchoice_ids: [], qanswer_ids: [], qanswers_attributes: [], event_ids: [], + user_attributes: [:nickname, :name, :affiliation, :tshirt, :mobile, :volunteer_experience, :languages]) end end end diff --git a/app/controllers/admin/rooms_controller.rb b/app/controllers/admin/rooms_controller.rb index 0b6b53c3..1e4029f7 100644 --- a/app/controllers/admin/rooms_controller.rb +++ b/app/controllers/admin/rooms_controller.rb @@ -47,7 +47,7 @@ module Admin private def room_params - params[:room] + params.require(:room).permit(:name, :size) end end end diff --git a/app/controllers/admin/schedules_controller.rb b/app/controllers/admin/schedules_controller.rb index 0a939db8..4b8de9f3 100644 --- a/app/controllers/admin/schedules_controller.rb +++ b/app/controllers/admin/schedules_controller.rb @@ -19,7 +19,7 @@ module Admin def update authorize! :update, @conference.events.new - event = Event.where(guid: params[:event]).first + event = Event.where(guid: event_params).first error_message = nil if event.nil? error_message = "Could not find event GUID: #{params[:event]}" @@ -32,7 +32,7 @@ module Admin render json: { 'status' => 'ok' } return end - room = Room.where(guid: params[:room]).first + room = Room.where(guid: room_params).first if room.nil? error_message = "Could not find room GUID: #{params[:room]}" end @@ -55,5 +55,15 @@ module Admin event.save! render json: { 'status' => 'ok' } end + + private + + def event_params + params.require(:event).permit(:guid) + end + + def room_params + params.require(:room).permit(:guid) + end end end diff --git a/app/controllers/admin/splashpages_controller.rb b/app/controllers/admin/splashpages_controller.rb index 7359cf60..9a0f26ff 100644 --- a/app/controllers/admin/splashpages_controller.rb +++ b/app/controllers/admin/splashpages_controller.rb @@ -43,7 +43,11 @@ module Admin private def splashpage_params - params[:splashpage] + params.require(:splashpage).permit(:public, + :include_tracks, :include_program, :include_cfp, + :include_venue, :include_registrations, + :include_tickets, :include_lodgings, + :include_sponsors, :include_social_media) end end end diff --git a/app/controllers/admin/sponsors_controller.rb b/app/controllers/admin/sponsors_controller.rb index 64db50d9..1aeb1b3d 100644 --- a/app/controllers/admin/sponsors_controller.rb +++ b/app/controllers/admin/sponsors_controller.rb @@ -49,7 +49,7 @@ module Admin private def sponsor_params - params[:sponsor] + params.require(:sponsor).permit(:name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id) end end end diff --git a/app/controllers/admin/sponsorship_levels_controller.rb b/app/controllers/admin/sponsorship_levels_controller.rb index a4f0095b..82d20e4e 100644 --- a/app/controllers/admin/sponsorship_levels_controller.rb +++ b/app/controllers/admin/sponsorship_levels_controller.rb @@ -59,7 +59,7 @@ module Admin private def sponsorship_level_params - params[:sponsorship_level] + params.require(:sponsorship_level).permit(:title, :conference_id) end end end diff --git a/app/controllers/admin/targets_controller.rb b/app/controllers/admin/targets_controller.rb index b0e11520..6f73dc0a 100644 --- a/app/controllers/admin/targets_controller.rb +++ b/app/controllers/admin/targets_controller.rb @@ -48,7 +48,7 @@ module Admin private def target_params - params[:target] + params.require(:target).permit(:due_date, :target_count, :unit, :conference_id) end end end diff --git a/app/controllers/admin/tickets_controller.rb b/app/controllers/admin/tickets_controller.rb index de27459a..ec131971 100644 --- a/app/controllers/admin/tickets_controller.rb +++ b/app/controllers/admin/tickets_controller.rb @@ -48,7 +48,7 @@ module Admin private def ticket_params - params[:ticket] + params.require(:ticket).permit(:conference, :title, :url, :description, :conference_id, :price_cents, :price_currency, :price) end end end diff --git a/app/controllers/admin/tracks_controller.rb b/app/controllers/admin/tracks_controller.rb index 438b3dd0..db69b574 100644 --- a/app/controllers/admin/tracks_controller.rb +++ b/app/controllers/admin/tracks_controller.rb @@ -52,7 +52,7 @@ module Admin private def track_params - params[:track] + params.require(:track).permit(:name, :description, :color) end end end diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb index 607cbe7b..af74d3e6 100644 --- a/app/controllers/admin/users_controller.rb +++ b/app/controllers/admin/users_controller.rb @@ -27,7 +27,7 @@ module Admin end end - if @user.update_attributes(params[:user]) + if @user.update_attributes(user_params) redirect_to admin_users_path, notice: "Updated #{@user.name} (#{@user.email})!" + message else redirect_to admin_users_path, alert: "Could not update #{@user.name} (#{@user.email}). #{@user.errors.full_messages.join('. ')}." @@ -35,5 +35,12 @@ module Admin end def edit; end + + private + + def user_params + params.require(:user).permit(:email, :name, :email_public, :biography, :nickname, :affiliation, :is_admin, :username, :login, :is_disabled, + :tshirt, :mobile, :volunteer_experience, :languages, role_ids: []) + end end end diff --git a/app/controllers/admin/venues_controller.rb b/app/controllers/admin/venues_controller.rb index 8cda7eed..f9efbbe1 100644 --- a/app/controllers/admin/venues_controller.rb +++ b/app/controllers/admin/venues_controller.rb @@ -44,7 +44,7 @@ module Admin private def venue_params - params[:venue] + params.require(:venue).permit(:name, :street, :postalcode, :city, :country, :longitude, :latitude, :description, :website, :photo, :lodgings_attributes, :conference_id) end end end diff --git a/app/controllers/admin/volunteers_controller.rb b/app/controllers/admin/volunteers_controller.rb index 558b20cb..89f6d83a 100644 --- a/app/controllers/admin/volunteers_controller.rb +++ b/app/controllers/admin/volunteers_controller.rb @@ -24,7 +24,7 @@ module Admin def update if can_manage_volunteers(@conference) - if @conference.update_attributes(params[:conference]) + if @conference.update_attributes(conference_params) redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: 'Volunteering options were successfully updated.') else redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{@conference.errors.full_messages.join '. '}") @@ -33,5 +33,11 @@ module Admin authorize! :index, :volunteer end end + + private + + def conference_params + params.require(:conference).permit! + end end end diff --git a/app/controllers/commercials_controller.rb b/app/controllers/commercials_controller.rb index c2992594..08d77ab9 100644 --- a/app/controllers/commercials_controller.rb +++ b/app/controllers/commercials_controller.rb @@ -46,7 +46,6 @@ class CommercialsController < ApplicationController end def commercial_params - #params.require(:commercial).permit(:commercial_id, :commercial_type) - params[:commercial] + params.require(:commercial).permit(:commercial_id, :commercial_type) end end diff --git a/app/controllers/conference_controller.rb b/app/controllers/conference_controller.rb index 3ba355fd..3923d6e7 100644 --- a/app/controllers/conference_controller.rb +++ b/app/controllers/conference_controller.rb @@ -28,9 +28,9 @@ class ConferenceController < ApplicationController private - def respond_to_options - respond_to do |format| - format.html { head :ok } - end if request.options? - end + def respond_to_options + respond_to do |format| + format.html { head :ok } + end if request.options? + end end diff --git a/app/controllers/proposal_controller.rb b/app/controllers/proposal_controller.rb index 2bc9e099..18d985b3 100644 --- a/app/controllers/proposal_controller.rb +++ b/app/controllers/proposal_controller.rb @@ -26,7 +26,7 @@ class ProposalController < ApplicationController @url = conference_proposal_index_path(@conference.short_title) unless current_user - @user = User.new(params[:user]) + @user = User.new(user_params) if @user.save sign_in(@user) else @@ -38,7 +38,7 @@ class ProposalController < ApplicationController params[:event].delete :user - @event = Event.new(params[:event]) + @event = Event.new(event_params) @event.conference = @conference @event.event_users.new(user: current_user, @@ -62,17 +62,7 @@ class ProposalController < ApplicationController authorize! :update, @event @url = conference_proposal_path(@conference.short_title, params[:id]) - # First, update the submitter's info, if they've changed anything - current_user.assign_attributes(params[:user]) - if current_user.changed? - current_user.save - end - - # FIXME: Hmmmmm - params[:event].delete :users_attributes - params[:event].delete :user - - if !@event.update(params[:event]) + if !@event.update(event_params) flash[:error] = "Could not update proposal: #{@event.errors.full_messages.join(', ')}" render action: 'new' return @@ -145,6 +135,16 @@ class ProposalController < ApplicationController redirect_to(conference_proposal_index_path(conference_id: @conference.short_title), notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.") end + + private + + def event_params + params.require(:event).permit(:title, :subtitle, :event_type_id, :abstract, :description, :require_registration, :difficulty_level_id) + end + + def user_params + params.require(:user).permit(:email, :password, :password_confirmation, :username) + end end # FIXME: Introduce strong_parameters pronto! diff --git a/app/controllers/ticket_purchases_controller.rb b/app/controllers/ticket_purchases_controller.rb index d54f271f..395f09ce 100644 --- a/app/controllers/ticket_purchases_controller.rb +++ b/app/controllers/ticket_purchases_controller.rb @@ -29,4 +29,10 @@ class TicketPurchasesController < ApplicationController "#{@ticket_purchases.errors.full_messages.join('. ')}." end end + + private + + def ticket_purchase_params + params.require(:ticket_purchase).permit(:ticket_id, :user_id, :conference_id, :quantity) + end end diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index edff9a95..a453c83f 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -24,6 +24,6 @@ class UsersController < ApplicationController # Only allow a trusted parameter "white list" through. def user_params - params.require(:user).permit(:user_id, :name, :biography, :nickname, :affiliation) + params.require(:user).permit(:name, :biography, :nickname, :affiliation) end end diff --git a/app/models/answer.rb b/app/models/answer.rb index 0a38d33c..31dee54b 100644 --- a/app/models/answer.rb +++ b/app/models/answer.rb @@ -1,6 +1,4 @@ class Answer < ActiveRecord::Base - attr_accessible :title - has_many :qanswers has_many :questions, through: :qanswers diff --git a/app/models/call_for_paper.rb b/app/models/call_for_paper.rb index bb72a891..85d0e17d 100644 --- a/app/models/call_for_paper.rb +++ b/app/models/call_for_paper.rb @@ -1,8 +1,5 @@ class CallForPaper < ActiveRecord::Base belongs_to :conference - attr_accessible :start_date, :end_date, - :schedule_changes, :rating, - :schedule_public, :include_cfp_in_splash, :conference_id validates_presence_of :start_date, :end_date validates :rating, numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 10 } diff --git a/app/models/campaign.rb b/app/models/campaign.rb index 469f3433..66257371 100644 --- a/app/models/campaign.rb +++ b/app/models/campaign.rb @@ -1,7 +1,4 @@ class Campaign < ActiveRecord::Base - attr_accessible :name, :utm_source, :utm_medium, :utm_term, - :utm_content, :utm_campaign, :target_ids, :conference_id - validates :name, :utm_campaign, presence: true has_many :targets, dependent: :nullify diff --git a/app/models/comment.rb b/app/models/comment.rb index f668afb3..40d69240 100644 --- a/app/models/comment.rb +++ b/app/models/comment.rb @@ -1,6 +1,5 @@ class Comment < ActiveRecord::Base acts_as_nested_set scope: [:commentable_id, :commentable_type] - attr_accessible :commentable, :body, :user_id validates_presence_of :body validates_presence_of :user after_create :send_notification diff --git a/app/models/commercial.rb b/app/models/commercial.rb index d38661cd..6803b5bd 100644 --- a/app/models/commercial.rb +++ b/app/models/commercial.rb @@ -1,8 +1,6 @@ class Commercial < ActiveRecord::Base belongs_to :commercialable, polymorphic: true - attr_accessible :commercial_id, :commercial_type - validates :commercial_id, presence: true validates :commercial_type, presence: true diff --git a/app/models/conference.rb b/app/models/conference.rb index 9ebba2ef..8e658759 100644 --- a/app/models/conference.rb +++ b/app/models/conference.rb @@ -8,18 +8,6 @@ class Conference < ActiveRecord::Base default_scope { order('start_date DESC') } - attr_accessible :title, :short_title, :description, :timezone, :html_export_path, - :start_date, :end_date, :rooms_attributes, :tracks_attributes, - :dietary_choices_attributes, :use_dietary_choices, - :tickets_attributes, :social_events_attributes, :event_types_attributes, - :logo, :questions_attributes, - :question_ids, :answers_attributes, :answer_ids, :difficulty_levels_attributes, - :use_difficulty_levels, :use_vpositions, :use_vdays, :vdays_attributes, - :vpositions_attributes, :use_volunteers, :color, - :sponsorship_levels_attributes, :sponsors_attributes, - :photos_attributes, :targets, :targets_attributes, - :campaigns, :campaigns_attributes - has_paper_trail has_and_belongs_to_many :questions diff --git a/app/models/contact.rb b/app/models/contact.rb index 3eecfb43..3e45200a 100644 --- a/app/models/contact.rb +++ b/app/models/contact.rb @@ -1,7 +1,4 @@ class Contact < ActiveRecord::Base - attr_accessible :conference_id, :social_tag, :email, :facebook, :googleplus, :twitter, - :instagram, :public, :sponsor_email - belongs_to :conference validates :conference, presence: true diff --git a/app/models/dietary_choice.rb b/app/models/dietary_choice.rb index 961346b8..48ff7828 100644 --- a/app/models/dietary_choice.rb +++ b/app/models/dietary_choice.rb @@ -1,6 +1,4 @@ class DietaryChoice < ActiveRecord::Base - attr_accessible :title - belongs_to :conference has_many :registrations end diff --git a/app/models/difficulty_level.rb b/app/models/difficulty_level.rb index 36ec38c8..58f9862c 100644 --- a/app/models/difficulty_level.rb +++ b/app/models/difficulty_level.rb @@ -1,6 +1,4 @@ class DifficultyLevel < ActiveRecord::Base - attr_accessible :title, :description, :color, :conference_id - belongs_to :conference has_many :events, dependent: :nullify diff --git a/app/models/email_settings.rb b/app/models/email_settings.rb index 76cb7d9e..60889a15 100644 --- a/app/models/email_settings.rb +++ b/app/models/email_settings.rb @@ -1,14 +1,4 @@ class EmailSettings < ActiveRecord::Base - attr_accessible :send_on_registration, :registration_subject, :registration_body, - :send_on_accepted, :accepted_subject, :accepted_body, - :send_on_rejected, :rejected_subject, :rejected_body, - :send_on_confirmed_without_registration, :confirmed_without_registration_subject, :confirmed_without_registration_body, - :send_on_conference_dates_updated, :conference_dates_updated_subject, :conference_dates_updated_body, - :send_on_conference_registration_dates_updated, :conference_registration_dates_updated_subject, :conference_registration_dates_updated_body, - :send_on_venue_updated, :venue_updated_subject, :venue_updated_body, - :send_on_call_for_papers_dates_updated, :call_for_papers_dates_updated_subject, :call_for_papers_dates_updated_body, - :send_on_call_for_papers_schedule_public, :call_for_papers_schedule_public_subject, :call_for_papers_schedule_public_body - def get_values(conference, user, event = nil) h = { 'email' => user.email, diff --git a/app/models/event.rb b/app/models/event.rb index a182550c..ed67b07b 100644 --- a/app/models/event.rb +++ b/app/models/event.rb @@ -1,9 +1,6 @@ class Event < ActiveRecord::Base include ActiveRecord::Transitions has_paper_trail - attr_accessible :title, :subtitle, :abstract, :description, :user, :users_attributes, - :proposal_additional_speakers, :event_type_id, :track_id, - :difficulty_level_id, :require_registration, :is_highlight acts_as_commentable diff --git a/app/models/event_type.rb b/app/models/event_type.rb index 90abc542..d0a4a8f3 100644 --- a/app/models/event_type.rb +++ b/app/models/event_type.rb @@ -1,7 +1,4 @@ class EventType < ActiveRecord::Base - attr_accessible :title, :length, :minimum_abstract_length, :maximum_abstract_length, :color, - :conference_id, :description - belongs_to :conference has_many :events, dependent: :restrict_with_error diff --git a/app/models/event_user.rb b/app/models/event_user.rb index 2f71d330..64952a28 100644 --- a/app/models/event_user.rb +++ b/app/models/event_user.rb @@ -1,5 +1,4 @@ class EventUser < ActiveRecord::Base - attr_accessible :event, :user, :user_id, :event_role # TODO Do we need these roles? ROLES = [['Speaker', 'speaker'], ['Submitter', 'submitter'], ['Moderator', 'moderator']] diff --git a/app/models/events_registration.rb b/app/models/events_registration.rb index 1f0869b8..08dbb70e 100644 --- a/app/models/events_registration.rb +++ b/app/models/events_registration.rb @@ -1,6 +1,4 @@ class EventsRegistration < ActiveRecord::Base - attr_accessible :registration_id, :event_id - belongs_to :registration belongs_to :event end diff --git a/app/models/lodging.rb b/app/models/lodging.rb index 7c37a047..aa01505c 100644 --- a/app/models/lodging.rb +++ b/app/models/lodging.rb @@ -1,5 +1,4 @@ class Lodging < ActiveRecord::Base - attr_accessible :name, :description, :photo, :website_link, :conference_id belongs_to :conference validates :name, presence: true diff --git a/app/models/photo.rb b/app/models/photo.rb index 94be8716..91ab1dea 100644 --- a/app/models/photo.rb +++ b/app/models/photo.rb @@ -1,5 +1,4 @@ class Photo < ActiveRecord::Base - attr_accessible :picture, :description belongs_to :conference validates_presence_of :picture has_attached_file :picture, diff --git a/app/models/qanswer.rb b/app/models/qanswer.rb index 48448b04..730d98e7 100644 --- a/app/models/qanswer.rb +++ b/app/models/qanswer.rb @@ -1,6 +1,4 @@ class Qanswer < ActiveRecord::Base - attr_accessible :question_id, :answer_id - belongs_to :question belongs_to :answer, dependent: :delete diff --git a/app/models/question.rb b/app/models/question.rb index 28153dc6..f49e95a5 100644 --- a/app/models/question.rb +++ b/app/models/question.rb @@ -1,6 +1,4 @@ class Question < ActiveRecord::Base - attr_accessible :title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id - belongs_to :question_type has_and_belongs_to_many :conferences diff --git a/app/models/question_type.rb b/app/models/question_type.rb index 4d349253..df063568 100644 --- a/app/models/question_type.rb +++ b/app/models/question_type.rb @@ -1,5 +1,3 @@ class QuestionType < ActiveRecord::Base - attr_accessible :title, :description - has_many :questions end diff --git a/app/models/registration.rb b/app/models/registration.rb index 42e0be19..1866c430 100644 --- a/app/models/registration.rb +++ b/app/models/registration.rb @@ -11,10 +11,6 @@ class Registration < ActiveRecord::Base has_many :events_registrations has_many :workshops, through: :events_registrations, source: :event - attr_accessible :user_id, :conference_id, :arrival, :departure, :user_attributes, :attended, - :other_dietary_choice, :dietary_choice_id, :social_event_ids, :other_special_needs, - :event_ids, :volunteer, :vchoice_ids, :qanswer_ids, :qanswers_attributes - accepts_nested_attributes_for :user accepts_nested_attributes_for :social_events accepts_nested_attributes_for :qanswers diff --git a/app/models/registration_period.rb b/app/models/registration_period.rb index f37b5f2f..6a87b4f7 100644 --- a/app/models/registration_period.rb +++ b/app/models/registration_period.rb @@ -1,6 +1,4 @@ class RegistrationPeriod < ActiveRecord::Base - attr_accessible :description, :start_date, :end_date - validates :start_date, :end_date, presence: true belongs_to :conference diff --git a/app/models/role.rb b/app/models/role.rb index fc2f1e50..87bbe62f 100644 --- a/app/models/role.rb +++ b/app/models/role.rb @@ -1,5 +1,4 @@ class Role < ActiveRecord::Base - attr_accessible :name, :description has_and_belongs_to_many :users belongs_to :resource, polymorphic: true diff --git a/app/models/room.rb b/app/models/room.rb index 93f57a4b..5fee24ee 100644 --- a/app/models/room.rb +++ b/app/models/room.rb @@ -1,6 +1,4 @@ class Room < ActiveRecord::Base - attr_accessible :name, :size, :conference_id - belongs_to :conference has_many :events, dependent: :nullify diff --git a/app/models/social_event.rb b/app/models/social_event.rb index ba5ab251..e75224ab 100644 --- a/app/models/social_event.rb +++ b/app/models/social_event.rb @@ -1,6 +1,4 @@ class SocialEvent < ActiveRecord::Base - attr_accessible :title, :description, :date - belongs_to :conference has_and_belongs_to_many :registrations end diff --git a/app/models/splashpage.rb b/app/models/splashpage.rb index 07fbb5cc..1f7a5ff5 100644 --- a/app/models/splashpage.rb +++ b/app/models/splashpage.rb @@ -1,8 +1,3 @@ class Splashpage < ActiveRecord::Base belongs_to :conference - attr_accessible :public, - :include_tracks, :include_program, :include_cfp, - :include_venue, :include_registrations, - :include_tickets, :include_lodgings, - :include_sponsors, :include_social_media end diff --git a/app/models/sponsor.rb b/app/models/sponsor.rb index e6acad75..0981f24a 100644 --- a/app/models/sponsor.rb +++ b/app/models/sponsor.rb @@ -1,5 +1,4 @@ class Sponsor < ActiveRecord::Base - attr_accessible :name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id belongs_to :sponsorship_level belongs_to :conference has_attached_file :logo, diff --git a/app/models/sponsorship_level.rb b/app/models/sponsorship_level.rb index cfdc6a35..f947a60b 100644 --- a/app/models/sponsorship_level.rb +++ b/app/models/sponsorship_level.rb @@ -1,5 +1,4 @@ class SponsorshipLevel < ActiveRecord::Base - attr_accessible :title, :conference_id validates_presence_of :title belongs_to :conference acts_as_list scope: :conference diff --git a/app/models/subscription.rb b/app/models/subscription.rb index 8c870c19..7f39adf3 100644 --- a/app/models/subscription.rb +++ b/app/models/subscription.rb @@ -1,5 +1,4 @@ class Subscription < ActiveRecord::Base - attr_accessible :user_id, :conference_id validates_uniqueness_of :user_id, scope: [:conference_id] belongs_to :conference belongs_to :user diff --git a/app/models/target.rb b/app/models/target.rb index 19ee677e..9045a792 100644 --- a/app/models/target.rb +++ b/app/models/target.rb @@ -1,8 +1,6 @@ class Target < ActiveRecord::Base include ActionView::Helpers::TextHelper - attr_accessible :due_date, :target_count, :unit, :conference_id - default_scope { order('due_date ASC') } def self.units diff --git a/app/models/ticket.rb b/app/models/ticket.rb index 54c54667..d3b3d48b 100644 --- a/app/models/ticket.rb +++ b/app/models/ticket.rb @@ -3,7 +3,6 @@ class Ticket < ActiveRecord::Base has_many :ticket_purchases, dependent: :destroy has_many :buyers, -> { distinct }, through: :ticket_purchases, source: :user - attr_accessible :conference, :title, :url, :description, :conference_id, :price_cents, :price_currency, :price monetize :price_cents, with_model_currency: :price_currency # This validation is for the sake of simplicity. diff --git a/app/models/ticket_purchase.rb b/app/models/ticket_purchase.rb index 89f992f8..8b0cd555 100644 --- a/app/models/ticket_purchase.rb +++ b/app/models/ticket_purchase.rb @@ -3,8 +3,6 @@ class TicketPurchase < ActiveRecord::Base belongs_to :user belongs_to :conference - attr_accessible :ticket_id, :user_id, :conference_id, :paid, :quantity - validates :ticket_id, :user_id, :conference_id, :quantity, presence: true validates_numericality_of :quantity, greater_than: 0 diff --git a/app/models/track.rb b/app/models/track.rb index 7f8cfbcb..c1c774a2 100644 --- a/app/models/track.rb +++ b/app/models/track.rb @@ -1,5 +1,4 @@ class Track < ActiveRecord::Base - attr_accessible :name, :description, :color, :conference_id belongs_to :conference has_many :events, dependent: :nullify diff --git a/app/models/user.rb b/app/models/user.rb index 568a1c89..fff4b120 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -32,10 +32,6 @@ class User < ActiveRecord::Base has_and_belongs_to_many :roles has_many :openids - attr_accessible :email, :password, :password_confirmation, :remember_me, :role_id, :role_ids, - :name, :email_public, :biography, :nickname, :affiliation, :is_admin, - :tshirt, :mobile, :volunteer_experience, :languages, :username, :login, :is_disabled - attr_accessor :login has_many :event_users, dependent: :destroy diff --git a/app/models/vday.rb b/app/models/vday.rb index a752c12f..33de4ba7 100644 --- a/app/models/vday.rb +++ b/app/models/vday.rb @@ -1,6 +1,4 @@ class Vday < ActiveRecord::Base - attr_accessible :day, :description - belongs_to :conference has_many :vchoices diff --git a/app/models/venue.rb b/app/models/venue.rb index faaba955..b88a1806 100644 --- a/app/models/venue.rb +++ b/app/models/venue.rb @@ -3,7 +3,6 @@ class Venue < ActiveRecord::Base has_many :lodgings before_create :generate_guid - attr_accessible :name, :street, :postalcode, :city, :country, :longitude, :latitude, :description, :website, :photo, :lodgings_attributes, :conference_id validates :name, :street, :city, :country, presence: true has_attached_file :photo, diff --git a/app/models/vote.rb b/app/models/vote.rb index 2ef9729f..e7da3c17 100644 --- a/app/models/vote.rb +++ b/app/models/vote.rb @@ -1,6 +1,4 @@ class Vote < ActiveRecord::Base - attr_accessible :rating - belongs_to :user belongs_to :event delegate :name, to: :user diff --git a/app/models/vposition.rb b/app/models/vposition.rb index 4f6e0966..3220aaa7 100644 --- a/app/models/vposition.rb +++ b/app/models/vposition.rb @@ -1,6 +1,4 @@ class Vposition < ActiveRecord::Base - attr_accessible :title, :description, :vday_ids - belongs_to :conference has_many :vchoices diff --git a/app/views/conference/_all_events.html.erb b/app/views/conference/_all_events.html.erb index 248cd604..130dceca 100644 --- a/app/views/conference/_all_events.html.erb +++ b/app/views/conference/_all_events.html.erb @@ -16,4 +16,4 @@ <%= link_to 'more', conference_proposal_path(@conference.short_title, event.id) if event.abstract.length > 400 %>

-<% end %> \ No newline at end of file +<% end %> diff --git a/config/application.rb b/config/application.rb index 43872169..91ac6591 100644 --- a/config/application.rb +++ b/config/application.rb @@ -53,7 +53,7 @@ module Osem # This will create an empty whitelist of attributes available for mass-assignment for all models # in your app. As such, your models will need to explicitly whitelist or blacklist accessible # parameters by using an attr_accessible or attr_protected declaration. - config.active_record.whitelist_attributes = true + # config.active_record.whitelist_attributes = true # Enable the asset pipeline config.assets.enabled = true diff --git a/config/environments/development.rb b/config/environments/development.rb index 8167887f..e1610a27 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -23,7 +23,7 @@ Osem::Application.configure do config.action_dispatch.best_standards_support = :builtin # Raise exception on mass assignment protection for Active Record models - config.active_record.mass_assignment_sanitizer = :strict + # config.active_record.mass_assignment_sanitizer = :strict # Do not compress assets config.assets.compress = false diff --git a/config/environments/test.rb b/config/environments/test.rb index 05845254..bac307fa 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -30,7 +30,7 @@ Osem::Application.configure do config.action_mailer.delivery_method = :test # Raise exception on mass assignment protection for Active Record models - config.active_record.mass_assignment_sanitizer = :strict + # config.active_record.mass_assignment_sanitizer = :strict # Print deprecation notices to the stderr config.active_support.deprecation = :stderr diff --git a/db/migrate/20140731165107_move_conference_contact_details_to_contact.rb b/db/migrate/20140731165107_move_conference_contact_details_to_contact.rb index 1bbbbb4f..6098c024 100644 --- a/db/migrate/20140731165107_move_conference_contact_details_to_contact.rb +++ b/db/migrate/20140731165107_move_conference_contact_details_to_contact.rb @@ -5,7 +5,6 @@ class MoveConferenceContactDetailsToContact < ActiveRecord::Migration class TempContact < ActiveRecord::Base self.table_name = 'contacts' - attr_accessible :conference_id, :social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public end def change diff --git a/db/migrate/20140801164901_move_conference_media_to_commercial.rb b/db/migrate/20140801164901_move_conference_media_to_commercial.rb index b4510c39..d22f541c 100644 --- a/db/migrate/20140801164901_move_conference_media_to_commercial.rb +++ b/db/migrate/20140801164901_move_conference_media_to_commercial.rb @@ -5,7 +5,6 @@ class MoveConferenceMediaToCommercial < ActiveRecord::Migration class TempCommercial < ActiveRecord::Base self.table_name = 'commercials' - attr_accessible :commercial_id, :commercial_type, :commercialable_id, :commercialable_type end def change diff --git a/db/migrate/20140801170430_move_event_media_to_commercial.rb b/db/migrate/20140801170430_move_event_media_to_commercial.rb index 9bbac74a..b4fdc16f 100644 --- a/db/migrate/20140801170430_move_event_media_to_commercial.rb +++ b/db/migrate/20140801170430_move_event_media_to_commercial.rb @@ -5,7 +5,6 @@ class MoveEventMediaToCommercial < ActiveRecord::Migration class TempCommercial < ActiveRecord::Base self.table_name = 'commercials' - attr_accessible :commercial_id, :commercial_type, :commercialable_id, :commercialable_type end def change diff --git a/db/migrate/20140812065531_move_conference_registration_data_to_registration_periods.rb b/db/migrate/20140812065531_move_conference_registration_data_to_registration_periods.rb index 87ada43f..7d86ae75 100644 --- a/db/migrate/20140812065531_move_conference_registration_data_to_registration_periods.rb +++ b/db/migrate/20140812065531_move_conference_registration_data_to_registration_periods.rb @@ -5,7 +5,6 @@ class MoveConferenceRegistrationDataToRegistrationPeriods < ActiveRecord::Migrat class TempRegistrationPeriod < ActiveRecord::Base self.table_name = 'registration_periods' - attr_accessible :conference_id, :start_date, :end_date, :description end def up diff --git a/db/migrate/20140820093735_migrating_supporter_registrations_to_ticket_users.rb b/db/migrate/20140820093735_migrating_supporter_registrations_to_ticket_users.rb index e3208691..5affe0cf 100644 --- a/db/migrate/20140820093735_migrating_supporter_registrations_to_ticket_users.rb +++ b/db/migrate/20140820093735_migrating_supporter_registrations_to_ticket_users.rb @@ -1,17 +1,14 @@ class MigratingSupporterRegistrationsToTicketUsers < ActiveRecord::Migration class TempSupporterRegistrations < ActiveRecord::Base self.table_name = 'supporter_registrations' - attr_accessible :conference_id, :supporter_level_id, :registration_id, :user_id end class TempUser < ActiveRecord::Base self.table_name = 'users' - attr_accessible :user_id end class TempRegistration < ActiveRecord::Base self.table_name = 'registrations' - attr_accessible :user_id end def change diff --git a/db/migrate/20140820123503_assign_users_to_events.rb b/db/migrate/20140820123503_assign_users_to_events.rb index c2e6f2f1..dc0334a7 100644 --- a/db/migrate/20140820123503_assign_users_to_events.rb +++ b/db/migrate/20140820123503_assign_users_to_events.rb @@ -5,14 +5,12 @@ class AssignUsersToEvents < ActiveRecord::Migration class TempUser < ActiveRecord::Base self.table_name = 'users' - attr_accessible :email, :name, :biography, :password end class TempEventUser < ActiveRecord::Base self.table_name = 'event_users' belongs_to :temp_event belongs_to :temp_user - attr_accessible :event_id, :user_id, :event_role end def up diff --git a/db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb b/db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb index ef2385f2..60b77df2 100644 --- a/db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb +++ b/db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb @@ -11,7 +11,6 @@ class UndoWrongMigration20140801080705AddUsersToEvents < ActiveRecord::Migration self.table_name = 'event_users' belongs_to :temp_event belongs_to :temp_user - attr_accessible :event_id, :user_id, :event_role end class Version < ActiveRecord::Base diff --git a/db/migrate/20140821103643_split_ticket_price_in_price_and_currency.rb b/db/migrate/20140821103643_split_ticket_price_in_price_and_currency.rb index 1f76c03e..0dbf1045 100644 --- a/db/migrate/20140821103643_split_ticket_price_in_price_and_currency.rb +++ b/db/migrate/20140821103643_split_ticket_price_in_price_and_currency.rb @@ -1,7 +1,6 @@ class SplitTicketPriceInPriceAndCurrency < ActiveRecord::Migration class TempTicket < ActiveRecord::Base self.table_name = 'tickets' - attr_accessible :ticket_price, :price_cents, :price_currency end def change diff --git a/db/migrate/20140825093132_move_splashpage_attributes_from_conference_to_splashpage.rb b/db/migrate/20140825093132_move_splashpage_attributes_from_conference_to_splashpage.rb index 9beac068..222fa20b 100644 --- a/db/migrate/20140825093132_move_splashpage_attributes_from_conference_to_splashpage.rb +++ b/db/migrate/20140825093132_move_splashpage_attributes_from_conference_to_splashpage.rb @@ -17,10 +17,6 @@ class MoveSplashpageAttributesFromConferenceToSplashpage < ActiveRecord::Migrati class TempSplashpage < ActiveRecord::Base self.table_name = 'splashpages' - attr_accessible :conference_id, :public, :include_registrations, :include_tracks, :include_program, - :include_social_media, :include_banner, :include_tickets, :ticket_description, :include_sponsors, - :sponsor_description, :lodging_description, :banner_photo_file_name, :banner_photo_content_type, - :banner_photo_file_size, :banner_photo_updated_at, :banner_description end def change diff --git a/db/migrate/20141031225545_add_require_handicapped_access_to_questions.rb b/db/migrate/20141031225545_add_require_handicapped_access_to_questions.rb index 8e25ee05..ed0d1f99 100644 --- a/db/migrate/20141031225545_add_require_handicapped_access_to_questions.rb +++ b/db/migrate/20141031225545_add_require_handicapped_access_to_questions.rb @@ -3,7 +3,6 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration self.table_name = 'registrations' belongs_to :temp_conference - attr_accessible :handicapped_access_required end class TempConference < ActiveRecord::Base @@ -16,14 +15,12 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration class TempQuestionType < ActiveRecord::Base self.table_name = 'question_types' - attr_accessible :title has_many :temp_questions end class TempQuestion < ActiveRecord::Base self.table_name = 'questions' - attr_accessible :title, :global, :question_type_id has_many :temp_qanswers has_many :temp_answers, through: :temp_qanswers belongs_to :temp_question_type @@ -33,7 +30,6 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration class TempAnswer < ActiveRecord::Base self.table_name = 'answers' - attr_accessible :title has_many :temp_qanswers has_many :temp_questions, through: :temp_qanswers end @@ -41,21 +37,16 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration class TempQanswer < ActiveRecord::Base self.table_name = 'qanswers' - attr_accessible :question_id, :answer_id belongs_to :temp_question belongs_to :temp_answer end class TempConferencesQuestions < ActiveRecord::Base self.table_name = 'conferences_questions' - - attr_accessible :question_id, :conference_id end class TempQanswerRegistration < ActiveRecord::Base self.table_name = 'qanswers_registrations' - - attr_accessible :registration_id, :qanswer_id end def change diff --git a/db/migrate/20141031225606_add_attending_with_partner_to_questions.rb b/db/migrate/20141031225606_add_attending_with_partner_to_questions.rb index 07f30891..a7014539 100644 --- a/db/migrate/20141031225606_add_attending_with_partner_to_questions.rb +++ b/db/migrate/20141031225606_add_attending_with_partner_to_questions.rb @@ -3,7 +3,6 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration self.table_name = 'registrations' belongs_to :temp_conference - attr_accessible :attending_with_partner end class TempConference < ActiveRecord::Base @@ -16,14 +15,12 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration class TempQuestionType < ActiveRecord::Base self.table_name = 'question_types' - attr_accessible :title has_many :temp_questions end class TempQuestion < ActiveRecord::Base self.table_name = 'questions' - attr_accessible :title, :global, :question_type_id has_many :temp_qanswers has_many :temp_answers, through: :temp_qanswers belongs_to :temp_question_type @@ -33,7 +30,6 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration class TempAnswer < ActiveRecord::Base self.table_name = 'answers' - attr_accessible :title has_many :temp_qanswers has_many :temp_questions, through: :temp_qanswers end @@ -41,21 +37,16 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration class TempQanswer < ActiveRecord::Base self.table_name = 'qanswers' - attr_accessible :question_id, :answer_id belongs_to :temp_question belongs_to :temp_answer end class TempConferencesQuestions < ActiveRecord::Base self.table_name = 'conferences_questions' - - attr_accessible :question_id, :conference_id end class TempQanswerRegistration < ActiveRecord::Base self.table_name = 'qanswers_registrations' - - attr_accessible :registration_id, :qanswer_id end def change diff --git a/db/migrate/20141031225620_add_staying_at_suggested_hotel_to_questions.rb b/db/migrate/20141031225620_add_staying_at_suggested_hotel_to_questions.rb index 55ad4869..71897787 100644 --- a/db/migrate/20141031225620_add_staying_at_suggested_hotel_to_questions.rb +++ b/db/migrate/20141031225620_add_staying_at_suggested_hotel_to_questions.rb @@ -3,7 +3,6 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration self.table_name = 'registrations' belongs_to :temp_conference - attr_accessible :using_affiliated_lodging end class TempConference < ActiveRecord::Base @@ -16,14 +15,12 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration class TempQuestionType < ActiveRecord::Base self.table_name = 'question_types' - attr_accessible :title has_many :temp_questions end class TempQuestion < ActiveRecord::Base self.table_name = 'questions' - attr_accessible :title, :global, :question_type_id has_many :temp_qanswers has_many :temp_answers, through: :temp_qanswers belongs_to :temp_question_type @@ -33,7 +30,6 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration class TempAnswer < ActiveRecord::Base self.table_name = 'answers' - attr_accessible :title has_many :temp_qanswers has_many :temp_questions, through: :temp_qanswers end @@ -41,21 +37,16 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration class TempQanswer < ActiveRecord::Base self.table_name = 'qanswers' - attr_accessible :question_id, :answer_id belongs_to :temp_question belongs_to :temp_answer end class TempConferencesQuestions < ActiveRecord::Base self.table_name = 'conferences_questions' - - attr_accessible :question_id, :conference_id end class TempQanswerRegistration < ActiveRecord::Base self.table_name = 'qanswers_registrations' - - attr_accessible :registration_id, :qanswer_id end def change diff --git a/db/migrate/20141031225635_add_attending_social_events_to_questions.rb b/db/migrate/20141031225635_add_attending_social_events_to_questions.rb index 985b6e17..ba950b10 100644 --- a/db/migrate/20141031225635_add_attending_social_events_to_questions.rb +++ b/db/migrate/20141031225635_add_attending_social_events_to_questions.rb @@ -2,7 +2,6 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration class TempRegistration < ActiveRecord::Base self.table_name = 'registrations' - attr_accessible :attending_social_events belongs_to :temp_conference end @@ -16,14 +15,12 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration class TempQuestionType < ActiveRecord::Base self.table_name = 'question_types' - attr_accessible :title has_many :temp_questions end class TempQuestion < ActiveRecord::Base self.table_name = 'questions' - attr_accessible :title, :global, :question_type_id has_many :temp_qanswers has_many :temp_answers, through: :temp_qanswers belongs_to :temp_question_type @@ -33,7 +30,6 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration class TempAnswer < ActiveRecord::Base self.table_name = 'answers' - attr_accessible :title has_many :temp_qanswers has_many :temp_questions, through: :temp_qanswers end @@ -41,21 +37,16 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration class TempQanswer < ActiveRecord::Base self.table_name = 'qanswers' - attr_accessible :question_id, :answer_id belongs_to :temp_question belongs_to :temp_answer end class TempConferencesQuestions < ActiveRecord::Base self.table_name = 'conferences_questions' - - attr_accessible :question_id, :conference_id end class TempQanswerRegistration < ActiveRecord::Base self.table_name = 'qanswers_registrations' - - attr_accessible :registration_id, :qanswer_id end def change diff --git a/db/migrate/20141104131625_generate_username.rb b/db/migrate/20141104131625_generate_username.rb index b598b452..d7f4bdda 100644 --- a/db/migrate/20141104131625_generate_username.rb +++ b/db/migrate/20141104131625_generate_username.rb @@ -1,7 +1,6 @@ class GenerateUsername < ActiveRecord::Migration class TempUser < ActiveRecord::Base self.table_name = 'users' - attr_accessible :username, :email end def change diff --git a/db/migrate/20141117214230_move_banner_description_to_conference.rb b/db/migrate/20141117214230_move_banner_description_to_conference.rb index c90c5a8f..6073926f 100644 --- a/db/migrate/20141117214230_move_banner_description_to_conference.rb +++ b/db/migrate/20141117214230_move_banner_description_to_conference.rb @@ -1,7 +1,6 @@ class MoveBannerDescriptionToConference < ActiveRecord::Migration class TempConference < ActiveRecord::Base self.table_name = 'conferences' - attr_accessible :description end class TempSplashpage < ActiveRecord::Base diff --git a/db/migrate/20141118153918_change_venue_conference_association.rb b/db/migrate/20141118153918_change_venue_conference_association.rb index 25f0d0f5..810179e5 100644 --- a/db/migrate/20141118153918_change_venue_conference_association.rb +++ b/db/migrate/20141118153918_change_venue_conference_association.rb @@ -5,7 +5,6 @@ class ChangeVenueConferenceAssociation < ActiveRecord::Migration class TempVenue < ActiveRecord::Base self.table_name = 'venues' - attr_accessible :conference_id end def change diff --git a/db/migrate/20141118162030_change_lodging_association_to_conference.rb b/db/migrate/20141118162030_change_lodging_association_to_conference.rb index 974754dc..e8699a07 100644 --- a/db/migrate/20141118162030_change_lodging_association_to_conference.rb +++ b/db/migrate/20141118162030_change_lodging_association_to_conference.rb @@ -9,7 +9,6 @@ class ChangeLodgingAssociationToConference < ActiveRecord::Migration class TempLodging < ActiveRecord::Base self.table_name = 'lodgings' - attr_accessible :conference_id end def change diff --git a/db/migrate/20141128073306_migrate_data_remove_column_include_cfp_in_splash_add_column_include_cfp.rb b/db/migrate/20141128073306_migrate_data_remove_column_include_cfp_in_splash_add_column_include_cfp.rb index 037cb077..8c44344b 100644 --- a/db/migrate/20141128073306_migrate_data_remove_column_include_cfp_in_splash_add_column_include_cfp.rb +++ b/db/migrate/20141128073306_migrate_data_remove_column_include_cfp_in_splash_add_column_include_cfp.rb @@ -9,7 +9,6 @@ class MigrateDataRemoveColumnIncludeCfpInSplashAddColumnIncludeCfp < ActiveRecor class TempSplashpage < ActiveRecord::Base self.table_name = 'splashpages' - attr_accessible :conference_id end def up diff --git a/spec/controllers/admin/registration_periods_controller_spec.rb b/spec/controllers/admin/registration_periods_controller_spec.rb index 982ae938..ae4586ea 100644 --- a/spec/controllers/admin/registration_periods_controller_spec.rb +++ b/spec/controllers/admin/registration_periods_controller_spec.rb @@ -22,7 +22,7 @@ describe Admin::RegistrationPeriodsController do context 'valid attributes' do it 'locates the requested registration period object' do - patch :update, conference_id: conference.short_title, conference: attributes_for(:registration_period) + patch :update, conference_id: conference.short_title, registration_period: attributes_for(:registration_period) expect(assigns(:registration_period)).to eq(conference.registration_period) end diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb index 1a9b9569..979d0ba1 100644 --- a/spec/controllers/admin/users_controller_spec.rb +++ b/spec/controllers/admin/users_controller_spec.rb @@ -20,18 +20,19 @@ describe Admin::UsersController do end describe 'PATCH #update' do context 'valid attributes' do + before :each do + patch :update, id: user.id, user: { name: 'new name', email: 'new_email@osem.io' } + end + it 'locates requested @user' do - patch :update, id: user.id expect(build(:user, id: user.id)).to eq(user) end it 'changes @users attributes' do - patch :update, id: user.id expect(build( - :user, email: 'new@email.osem', id: user.id).email). - to eq('new@email.osem') + :user, email: 'email_new@osem.io', id: user.id).email). + to eq('email_new@osem.io') end it 'redirects to the updated user' do - patch :update, id: user.id expect(response).to redirect_to admin_users_path end end diff --git a/spec/features/ability_spec.rb b/spec/features/ability_spec.rb index c7abb168..1056ad0e 100644 --- a/spec/features/ability_spec.rb +++ b/spec/features/ability_spec.rb @@ -2,11 +2,11 @@ require 'spec_helper' feature 'Has correct abilities' do # It is necessary to use bang version of let to build roles before user - let(:conference1) { create(:conference, venue: create(:venue)) } # user is organizer - let(:conference2) { create(:conference, venue: create(:venue)) } # user is cfp - let(:conference3) { create(:conference, venue: create(:venue)) } # user is info_desk - let(:conference4) { create(:conference, venue: create(:venue)) } # user is volunteer coordinator - let(:conference5) { create(:conference, venue: create(:venue)) } # user has no role + let(:conference1) { create(:conference) } # user is organizer + let(:conference2) { create(:conference) } # user is cfp + let(:conference3) { create(:conference) } # user is info_desk + let(:conference4) { create(:conference) } # user is volunteer coordinator + let(:conference5) { create(:conference) } # user has no role let(:role_organizer) { create(:role, name: 'organizer', resource: conference1) } let(:role_cfp) { create(:role, name: 'cfp', resource: conference2) } @@ -77,6 +77,10 @@ feature 'Has correct abilities' do visit admin_conference_targets_path(conference1.short_title) expect(current_path).to eq(admin_conference_targets_path(conference1.short_title)) + visit new_admin_conference_venue_path(conference1.short_title) + expect(current_path).to eq(new_admin_conference_venue_path(conference1.short_title)) + + conference1.venue = create(:venue) visit edit_admin_conference_venue_path(conference1.short_title) expect(current_path).to eq(edit_admin_conference_venue_path(conference1.short_title))