gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Introduce strong parameters

Browse source
This commit is contained in:
Stella Rouzi 2015-10-28 18:05:15 +02:00
parent 38bc2e3c3a
commit 355ecc0ac6
93 changed files with 172 additions and 241 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/admin/call_for_papers_controller.rb
View file

@ -26,12 +26,12 @@ module Admin
def update
authorize! :update, @conference.call_for_paper
@cfp = @conference.call_for_paper
@cfp.assign_attributes(params[:call_for_paper])
@cfp.assign_attributes(call_for_paper_params)
send_mail_on_schedule_public = @cfp.notify_on_schedule_public?
send_mail_on_cfp_dates_updated = @cfp.notify_on_cfp_date_update?
if @cfp.update_attributes(params[:call_for_paper])
if @cfp.update_attributes(call_for_paper_params)
Mailbot.delay.send_on_call_for_papers_dates_updated(@conference) if send_mail_on_cfp_dates_updated
Mailbot.delay.send_on_schedule_public(@conference) if send_mail_on_schedule_public
redirect_to(admin_conference_call_for_paper_path(@conference.short_title),
@ -54,7 +54,7 @@ module Admin
private
def call_for_paper_params
params[:call_for_paper]
params.require(:call_for_paper).permit(:start_date, :end_date, :schedule_changes, :rating, :schedule_public, :include_cfp_in_splash, :conference_id)
end
end
end

10
app/controllers/admin/campaigns_controller.rb
View file

@ -9,7 +9,7 @@ module Admin
end
def create
@campaign.attributes = params[:campaign]
@campaign.attributes = campaign_params
if @conference.save
flash[:notice] = 'Campaign successfully created.'
@ -25,7 +25,7 @@ module Admin
def edit; end
def update
if @campaign.update_attributes(params[:campaign])
if @campaign.update_attributes(campaign_params)
flash[:notice] = "Campaign '#{@campaign.name}' successfully updated."
redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title))
else
@ -44,5 +44,11 @@ module Admin
redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title))
end
end
private
def campaign_params
params.require(:campaign).permit(:name, :utm_source, :utm_medium, :utm_term, :utm_content, :utm_campaign, :target_ids, :conference_id)
end
end
end

3
app/controllers/admin/commercials_controller.rb
View file

@ -45,8 +45,7 @@ module Admin
private
def commercial_params
#params.require(:commercial).permit(:commercial_id, :commercial_type)
params[:commercial]
params.require(:commercial).permit(:commercial_id, :commercial_type)
end
end
end

22
app/controllers/admin/conference_controller.rb
View file

@ -63,7 +63,7 @@ module Admin
end
def create
@conference = Conference.new(params[:conference])
@conference = Conference.new(conference_params)
if @conference.valid?
@conference.save
@ -79,10 +79,10 @@ module Admin
def update
@conference = Conference.find_by(short_title: params[:id])
short_title = @conference.short_title
@conference.assign_attributes(params[:conference])
@conference.assign_attributes(conference_params)
send_mail_on_conf_update = @conference.notify_on_dates_changed?
if @conference.update_attributes(params[:conference])
if @conference.update_attributes(conference_params)
Mailbot.delay.conference_date_update_mail(@conference) if send_mail_on_conf_update
redirect_to(edit_admin_conference_path(id: @conference.short_title),
notice: 'Conference was successfully updated.')
@ -194,7 +194,21 @@ module Admin
render 'roles', formats: [:js]
end
protected
private
def conference_params
params.require(:conference).permit(:title, :short_title, :description, :timezone, :html_export_path,
:start_date, :end_date, :rooms_attributes, :tracks_attributes,
:dietary_choices_attributes, :use_dietary_choices,
:tickets_attributes, :social_events_attributes, :event_types_attributes,
:logo, :questions_attributes,
:question_ids, :answers_attributes, :answer_ids, :difficulty_levels_attributes,
:use_difficulty_levels, :use_vpositions, :use_vdays, :vdays_attributes,
:vpositions_attributes, :use_volunteers, :color,
:sponsorship_levels_attributes, :sponsors_attributes,
:photos_attributes, :targets, :targets_attributes,
:campaigns, :campaigns_attributes)
end
def get_users(role_name)
@role_users = {}

3
app/controllers/admin/contacts_controller.rb
View file

@ -22,8 +22,7 @@ module Admin
# Only allow a trusted parameter "white list" through.
def contact_params
# params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public)
params[:contact]
params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public, :sponsor_email)
end
end
end

2
app/controllers/admin/difficulty_levels_controller.rb
View file

@ -48,7 +48,7 @@ module Admin
private
def difficulty_level_params
params[:difficulty_level]
params.require(:difficulty_level).permit(:title, :description, :color, :conference_id)
end
end
end

15
app/controllers/admin/emails_controller.rb
View file

@ -4,7 +4,7 @@ module Admin
load_and_authorize_resource class: EmailSettings
def update
@conference.email_settings.update_attributes(params[:email_settings])
@conference.email_settings.update_attributes(email_params)
redirect_to(admin_conference_emails_path(
@conference.short_title),
notice: 'Settings have been successfully updated.')
@ -14,5 +14,18 @@ module Admin
authorize! :index, @conference.email_settings
@settings = @conference.email_settings
end
private
def email_params
params.require(:email_settings).permit(:send_on_registration, :send_on_accepted, :send_on_rejected, :send_on_confirmed_without_registration,
:registration_subject, :accepted_subject, :rejected_subject, :confirmed_without_registration_subject,
:registration_body, :accepted_body, :rejected_body, :confirmed_without_registration_body,
:send_on_conference_dates_updated, :conference_dates_updated_subject, :conference_dates_updated_body,
:send_on_conference_registration_dates_updated, :conference_registration_dates_updated_subject, :conference_registration_dates_updated_body,
:send_on_venue_updated, :venue_updated_subject, :venue_updated_body,
:send_on_call_for_papers_dates_updated, :call_for_papers_dates_updated_subject, :call_for_papers_dates_updated_body,
:send_on_call_for_papers_schedule_public, :call_for_papers_schedule_public_subject, :call_for_papers_schedule_public_body)
end
end
end

2
app/controllers/admin/event_types_controller.rb
View file

@ -48,7 +48,7 @@ module Admin
private
def event_type_params
params[:event_type]
params.require(:event_type).permit(:title, :length, :minimum_abstract_length, :maximum_abstract_length, :color, :conference_id, :description)
end
end
end

19
app/controllers/admin/events_controller.rb
View file

@ -95,7 +95,7 @@ module Admin
end
def comment
comment = Comment.build_from(@event, current_user.id, params[:comment])
comment = Comment.build_from(@event, current_user.id, comment_params)
comment.save!
if !params[:parent].nil?
comment.move_to_child_of(params[:parent])
@ -105,8 +105,7 @@ module Admin
end
def update
if @event.submitter.update_attributes(params[:user]) &&
@event.update_attributes(params[:event])
if @event.update_attributes(event_params)
if request.xhr?
render js: 'index'
@ -167,6 +166,20 @@ module Admin
private
def event_params
params.require(:event).permit(
# Set also in proposals controller
:title, :subtitle, :event_type_id, :abstract, :description, :require_registration, :difficulty_level_id,
# Set only in admin/events controller
:track_id, :state, :language, :start_time, :is_highlight,
# Not used anymore?
:proposal_additional_speakers, :user, :users_attributes)
end
def comment_params
params.require(:comment).permit(:commentable, :body, :user_id)
end
def get_event
@event = @conference.events.find_by_id(params[:id])
if !@event

2
app/controllers/admin/lodgings_controller.rb
View file

@ -47,7 +47,7 @@ module Admin
private
def lodging_params
params[:lodging]
params.require(:lodging).permit(:name, :description, :photo, :website_link, :conference_id)
end
end
end

16
app/controllers/admin/questions_controller.rb
View file

@ -20,7 +20,7 @@ module Admin
end
def create
@question = @conference.questions.new(params[:question])
@question = @conference.questions.new(question_params)
@question.conference_id = @conference.id
authorize! :create, @question
@ -47,7 +47,7 @@ module Admin
# PUT questions/1
def update
if @question.update_attributes(params[:question])
if @question.update_attributes(question_params)
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed. #{@question.errors.full_messages.join('. ')}")
@ -57,7 +57,7 @@ module Admin
# Update questions used for the conference
def update_conference
authorize! :update, Question.new(conference_id: @conference.id)
if @conference.update_attributes(params[:conference])
if @conference.update_attributes(conference_params)
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
@ -93,5 +93,15 @@ module Admin
@questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
@questions_conference = @conference.questions
end
private
def question_params
params.require(:question).permit(:title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id)
end
def conference_params
params.require(:conference).permit(question_ids: [])
end
end
end

10
app/controllers/admin/registration_periods_controller.rb
View file

@ -8,7 +8,7 @@ module Admin
end
def create
@registration_period = @conference.build_registration_period(registration_period)
@registration_period = @conference.build_registration_period(registration_period_params)
send_mail_on_reg_update = @conference.notify_on_registration_dates_changed?
if @registration_period.save
@ -28,10 +28,10 @@ module Admin
end
def update
@registration_period.assign_attributes(registration_period)
@registration_period.assign_attributes(registration_period_params)
send_mail_on_reg_update = @conference.notify_on_registration_dates_changed?
if @registration_period.update(registration_period)
if @registration_period.update(registration_period_params)
Mailbot.delay.conference_registration_date_update_mail(@conference) if send_mail_on_reg_update
redirect_to admin_conference_registration_period_path(@conference.short_title),
notice: 'Registration Period successfully updated.'
@ -50,8 +50,8 @@ module Admin
private
def registration_period
params[:registration_period]
def registration_period_params
params.require(:registration_period).permit(:start_date, :end_date)
end
end
end

15
app/controllers/admin/registrations_controller.rb
View file

@ -45,22 +45,17 @@ module Admin
end
end
protected
private
def set_user
@user = User.find_by(id: @registration.user_id)
end
def registration_params
params.require(:registration).
permit(
:conference_id, :arrival, :departure,
:volunteer,
vchoice_ids: [], qanswer_ids: [], event_ids: [],
qanswers_attributes: [],
user_attributes: [
:id, :name, :tshirt, :mobile, :volunteer_experience, :languages,
:nickname, :affiliation])
params.require(:registration).permit(:user_id, :conference_id, :arrival, :departure, :attended,
:volunteer, :other_special_needs,
vchoice_ids: [], qanswer_ids: [], qanswers_attributes: [], event_ids: [],
user_attributes: [:nickname, :name, :affiliation, :tshirt, :mobile, :volunteer_experience, :languages])
end
end
end

2
app/controllers/admin/rooms_controller.rb
View file

@ -47,7 +47,7 @@ module Admin
private
def room_params
params[:room]
params.require(:room).permit(:name, :size)
end
end
end

14
app/controllers/admin/schedules_controller.rb
View file

@ -19,7 +19,7 @@ module Admin
def update
authorize! :update, @conference.events.new
event = Event.where(guid: params[:event]).first
event = Event.where(guid: event_params).first
error_message = nil
if event.nil?
error_message = "Could not find event GUID: #{params[:event]}"
@ -32,7 +32,7 @@ module Admin
render json: { 'status' => 'ok' }
return
end
room = Room.where(guid: params[:room]).first
room = Room.where(guid: room_params).first
if room.nil?
error_message = "Could not find room GUID: #{params[:room]}"
end
@ -55,5 +55,15 @@ module Admin
event.save!
render json: { 'status' => 'ok' }
end
private
def event_params
params.require(:event).permit(:guid)
end
def room_params
params.require(:room).permit(:guid)
end
end
end

6
app/controllers/admin/splashpages_controller.rb
View file

@ -43,7 +43,11 @@ module Admin
private
def splashpage_params
params[:splashpage]
params.require(:splashpage).permit(:public,
:include_tracks, :include_program, :include_cfp,
:include_venue, :include_registrations,
:include_tickets, :include_lodgings,
:include_sponsors, :include_social_media)
end
end
end

2
app/controllers/admin/sponsors_controller.rb
View file

@ -49,7 +49,7 @@ module Admin
private
def sponsor_params
params[:sponsor]
params.require(:sponsor).permit(:name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id)
end
end
end

2
app/controllers/admin/sponsorship_levels_controller.rb
View file

@ -59,7 +59,7 @@ module Admin
private
def sponsorship_level_params
params[:sponsorship_level]
params.require(:sponsorship_level).permit(:title, :conference_id)
end
end
end

2
app/controllers/admin/targets_controller.rb
View file

@ -48,7 +48,7 @@ module Admin
private
def target_params
params[:target]
params.require(:target).permit(:due_date, :target_count, :unit, :conference_id)
end
end
end

2
app/controllers/admin/tickets_controller.rb
View file

@ -48,7 +48,7 @@ module Admin
private
def ticket_params
params[:ticket]
params.require(:ticket).permit(:conference, :title, :url, :description, :conference_id, :price_cents, :price_currency, :price)
end
end
end

2
app/controllers/admin/tracks_controller.rb
View file

@ -52,7 +52,7 @@ module Admin
private
def track_params
params[:track]
params.require(:track).permit(:name, :description, :color)
end
end
end

9
app/controllers/admin/users_controller.rb
View file

@ -27,7 +27,7 @@ module Admin
end
end
if @user.update_attributes(params[:user])
if @user.update_attributes(user_params)
redirect_to admin_users_path, notice: "Updated #{@user.name} (#{@user.email})!" + message
else
redirect_to admin_users_path, alert: "Could not update #{@user.name} (#{@user.email}). #{@user.errors.full_messages.join('. ')}."
@ -35,5 +35,12 @@ module Admin
end
def edit; end
private
def user_params
params.require(:user).permit(:email, :name, :email_public, :biography, :nickname, :affiliation, :is_admin, :username, :login, :is_disabled,
:tshirt, :mobile, :volunteer_experience, :languages, role_ids: [])
end
end
end

2
app/controllers/admin/venues_controller.rb
View file

@ -44,7 +44,7 @@ module Admin
private
def venue_params
params[:venue]
params.require(:venue).permit(:name, :street, :postalcode, :city, :country, :longitude, :latitude, :description, :website, :photo, :lodgings_attributes, :conference_id)
end
end
end

8
app/controllers/admin/volunteers_controller.rb
View file

@ -24,7 +24,7 @@ module Admin
def update
if can_manage_volunteers(@conference)
if @conference.update_attributes(params[:conference])
if @conference.update_attributes(conference_params)
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: 'Volunteering options were successfully updated.')
else
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{@conference.errors.full_messages.join '. '}")
@ -33,5 +33,11 @@ module Admin
authorize! :index, :volunteer
end
end
private
def conference_params
params.require(:conference).permit!
end
end
end