Introduce strong parameters

Gemfile

@@ -94,9 +94,6 @@ gem 'font-awesome-rails'
 # for Markdown in description
 gem 'redcarpet'
 
-# FIXME: We should use http://weblog.rubyonrails.org/2012/3/21/strong-parameters/
-gem 'protected_attributes'
-
 # as rdoc generator
 gem 'rdoc-generator-fivefish'
 

Gemfile.lock

@@ -287,8 +287,6 @@ GEM
     prawn_rails (0.0.11)
       prawn (>= 0.11.1)
       railties (>= 3.0.0)
-    protected_attributes (1.0.7)
-      activemodel (>= 4.0.1, < 5.0)
     pry (0.9.12.6)
       coderay (~> 1.0)
       method_source (~> 0.8)
@@ -481,7 +479,6 @@ DEPENDENCIES
   piwik_analytics (~> 1.0.1)
   poltergeist
   prawn_rails
-  protected_attributes
   quiet_assets
   rails (~> 4.1)
   rails-observers

app/controllers/admin/call_for_papers_controller.rb

@@ -26,12 +26,12 @@ module Admin
     def update
       authorize! :update, @conference.call_for_paper
       @cfp = @conference.call_for_paper
-      @cfp.assign_attributes(params[:call_for_paper])
+      @cfp.assign_attributes(call_for_paper_params)
       send_mail_on_schedule_public = @cfp.notify_on_schedule_public?
 
       send_mail_on_cfp_dates_updated = @cfp.notify_on_cfp_date_update?
 
-      if @cfp.update_attributes(params[:call_for_paper])
+      if @cfp.update_attributes(call_for_paper_params)
         Mailbot.delay.send_on_call_for_papers_dates_updated(@conference) if send_mail_on_cfp_dates_updated
         Mailbot.delay.send_on_schedule_public(@conference) if send_mail_on_schedule_public
         redirect_to(admin_conference_call_for_paper_path(@conference.short_title),
@@ -54,7 +54,7 @@ module Admin
     private
 
     def call_for_paper_params
-      params[:call_for_paper]
+      params.require(:call_for_paper).permit(:start_date, :end_date, :schedule_changes, :rating, :schedule_public, :include_cfp_in_splash, :conference_id)
     end
   end
 end

app/controllers/admin/campaigns_controller.rb

@@ -9,7 +9,7 @@ module Admin
     end
 
     def create
-      @campaign.attributes = params[:campaign]
+      @campaign.attributes = campaign_params
 
       if @conference.save
         flash[:notice] = 'Campaign successfully created.'
@@ -25,7 +25,7 @@ module Admin
     def edit; end
 
     def update
-      if @campaign.update_attributes(params[:campaign])
+      if @campaign.update_attributes(campaign_params)
         flash[:notice] = "Campaign '#{@campaign.name}' successfully updated."
         redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title))
       else
@@ -44,5 +44,11 @@ module Admin
         redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title))
       end
     end
+
+    private
+
+    def campaign_params
+      params.require(:campaign).permit(:name, :utm_source, :utm_medium, :utm_term, :utm_content, :utm_campaign, :target_ids, :conference_id)
+    end
   end
 end

app/controllers/admin/commercials_controller.rb

@@ -45,8 +45,7 @@ module Admin
     private
 
     def commercial_params
-      #params.require(:commercial).permit(:commercial_id, :commercial_type)
+      params.require(:commercial).permit(:commercial_id, :commercial_type)
-      params[:commercial]
     end
   end
 end

app/controllers/admin/conference_controller.rb

@@ -63,7 +63,7 @@ module Admin
     end
 
     def create
-      @conference = Conference.new(params[:conference])
+      @conference = Conference.new(conference_params)
 
       if @conference.valid?
         @conference.save
@@ -79,10 +79,10 @@ module Admin
     def update
       @conference = Conference.find_by(short_title: params[:id])
       short_title = @conference.short_title
-      @conference.assign_attributes(params[:conference])
+      @conference.assign_attributes(conference_params)
       send_mail_on_conf_update = @conference.notify_on_dates_changed?
 
-      if @conference.update_attributes(params[:conference])
+      if @conference.update_attributes(conference_params)
         Mailbot.delay.conference_date_update_mail(@conference) if send_mail_on_conf_update
         redirect_to(edit_admin_conference_path(id: @conference.short_title),
                     notice: 'Conference was successfully updated.')
@@ -194,7 +194,21 @@ module Admin
       render 'roles', formats: [:js]
     end
 
-    protected
+    private
+
+    def conference_params
+      params.require(:conference).permit(:title, :short_title, :description, :timezone, :html_export_path,
+                                         :start_date, :end_date, :rooms_attributes, :tracks_attributes,
+                                         :dietary_choices_attributes, :use_dietary_choices,
+                                         :tickets_attributes, :social_events_attributes, :event_types_attributes,
+                                         :logo, :questions_attributes,
+                                         :question_ids, :answers_attributes, :answer_ids, :difficulty_levels_attributes,
+                                         :use_difficulty_levels, :use_vpositions, :use_vdays, :vdays_attributes,
+                                         :vpositions_attributes, :use_volunteers, :color,
+                                         :sponsorship_levels_attributes, :sponsors_attributes,
+                                         :photos_attributes, :targets, :targets_attributes,
+                                         :campaigns, :campaigns_attributes)
+    end
 
     def get_users(role_name)
       @role_users = {}

app/controllers/admin/contacts_controller.rb

@@ -22,8 +22,7 @@ module Admin
 
     # Only allow a trusted parameter "white list" through.
     def contact_params
-      # params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public)
+      params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public, :sponsor_email)
-      params[:contact]
     end
   end
 end

app/controllers/admin/difficulty_levels_controller.rb

@@ -48,7 +48,7 @@ module Admin
     private
 
     def difficulty_level_params
-      params[:difficulty_level]
+      params.require(:difficulty_level).permit(:title, :description, :color, :conference_id)
     end
   end
 end

app/controllers/admin/emails_controller.rb

@@ -4,7 +4,7 @@ module Admin
     load_and_authorize_resource class: EmailSettings
 
     def update
-      @conference.email_settings.update_attributes(params[:email_settings])
+      @conference.email_settings.update_attributes(email_params)
       redirect_to(admin_conference_emails_path(
                   @conference.short_title),
                   notice: 'Settings have been successfully updated.')
@@ -14,5 +14,18 @@ module Admin
       authorize! :index, @conference.email_settings
       @settings = @conference.email_settings
     end
+
+    private
+
+    def email_params
+      params.require(:email_settings).permit(:send_on_registration, :send_on_accepted, :send_on_rejected, :send_on_confirmed_without_registration,
+                                             :registration_subject, :accepted_subject, :rejected_subject, :confirmed_without_registration_subject,
+                                             :registration_body, :accepted_body, :rejected_body, :confirmed_without_registration_body,
+                                             :send_on_conference_dates_updated, :conference_dates_updated_subject, :conference_dates_updated_body,
+                                             :send_on_conference_registration_dates_updated, :conference_registration_dates_updated_subject, :conference_registration_dates_updated_body,
+                                             :send_on_venue_updated, :venue_updated_subject, :venue_updated_body,
+                                             :send_on_call_for_papers_dates_updated, :call_for_papers_dates_updated_subject, :call_for_papers_dates_updated_body,
+                                             :send_on_call_for_papers_schedule_public, :call_for_papers_schedule_public_subject, :call_for_papers_schedule_public_body)
+    end
   end
 end

app/controllers/admin/event_types_controller.rb

@@ -48,7 +48,7 @@ module Admin
     private
 
     def event_type_params
-      params[:event_type]
+      params.require(:event_type).permit(:title, :length, :minimum_abstract_length, :maximum_abstract_length, :color, :conference_id, :description)
     end
   end
 end

app/controllers/admin/events_controller.rb

@@ -95,7 +95,7 @@ module Admin
     end
 
     def comment
-      comment = Comment.build_from(@event, current_user.id, params[:comment])
+      comment = Comment.build_from(@event, current_user.id, comment_params)
       comment.save!
       if !params[:parent].nil?
         comment.move_to_child_of(params[:parent])
@@ -105,8 +105,7 @@ module Admin
     end
 
     def update
-      if @event.submitter.update_attributes(params[:user]) &&
+      if @event.update_attributes(event_params)
-        @event.update_attributes(params[:event])
 
         if request.xhr?
           render js: 'index'
@@ -167,6 +166,20 @@ module Admin
 
     private
 
+    def event_params
+      params.require(:event).permit(
+                                    # Set also in proposals controller
+                                    :title, :subtitle, :event_type_id, :abstract, :description, :require_registration, :difficulty_level_id,
+                                    # Set only in admin/events controller
+                                    :track_id, :state, :language, :start_time, :is_highlight,
+                                    # Not used anymore?
+                                    :proposal_additional_speakers, :user, :users_attributes)
+    end
+
+    def comment_params
+      params.require(:comment).permit(:commentable, :body, :user_id)
+    end
+
     def get_event
       @event = @conference.events.find_by_id(params[:id])
       if !@event

app/controllers/admin/lodgings_controller.rb

@@ -47,7 +47,7 @@ module Admin
     private
 
     def lodging_params
-      params[:lodging]
+      params.require(:lodging).permit(:name, :description, :photo, :website_link, :conference_id)
     end
   end
 end

app/controllers/admin/questions_controller.rb

@@ -20,7 +20,7 @@ module Admin
     end
 
     def create
-      @question = @conference.questions.new(params[:question])
+      @question = @conference.questions.new(question_params)
       @question.conference_id = @conference.id
       authorize! :create, @question
 
@@ -47,7 +47,7 @@ module Admin
 
     # PUT questions/1
     def update
-      if @question.update_attributes(params[:question])
+      if @question.update_attributes(question_params)
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
       else
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed. #{@question.errors.full_messages.join('. ')}")
@@ -57,7 +57,7 @@ module Admin
     # Update questions used for the conference
     def update_conference
       authorize! :update, Question.new(conference_id: @conference.id)
-      if @conference.update_attributes(params[:conference])
+      if @conference.update_attributes(conference_params)
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
       else
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
@@ -93,5 +93,15 @@ module Admin
       @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
       @questions_conference = @conference.questions
     end
+
+    private
+
+    def question_params
+      params.require(:question).permit(:title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id)
+    end
+
+    def conference_params
+      params.require(:conference).permit(question_ids: [])
+    end
   end
 end

app/controllers/admin/registration_periods_controller.rb

@@ -8,7 +8,7 @@ module Admin
     end
 
     def create
-      @registration_period = @conference.build_registration_period(registration_period)
+      @registration_period = @conference.build_registration_period(registration_period_params)
       send_mail_on_reg_update = @conference.notify_on_registration_dates_changed?
 
       if @registration_period.save
@@ -28,10 +28,10 @@ module Admin
     end
 
     def update
-      @registration_period.assign_attributes(registration_period)
+      @registration_period.assign_attributes(registration_period_params)
       send_mail_on_reg_update = @conference.notify_on_registration_dates_changed?
 
-      if @registration_period.update(registration_period)
+      if @registration_period.update(registration_period_params)
         Mailbot.delay.conference_registration_date_update_mail(@conference) if send_mail_on_reg_update
         redirect_to admin_conference_registration_period_path(@conference.short_title),
                     notice: 'Registration Period successfully updated.'
@@ -50,8 +50,8 @@ module Admin
 
     private
 
-    def registration_period
+    def registration_period_params
-      params[:registration_period]
+      params.require(:registration_period).permit(:start_date, :end_date)
     end
   end
 end

app/controllers/admin/registrations_controller.rb

@@ -45,22 +45,17 @@ module Admin
       end
     end
 
-    protected
+    private
 
     def set_user
       @user = User.find_by(id: @registration.user_id)
     end
 
     def registration_params
-      params.require(:registration).
+      params.require(:registration).permit(:user_id, :conference_id, :arrival, :departure, :attended,
-          permit(
+                                           :volunteer, :other_special_needs,
-              :conference_id, :arrival, :departure,
+                                           vchoice_ids: [], qanswer_ids: [], qanswers_attributes: [], event_ids: [],
-              :volunteer,
+                                           user_attributes: [:nickname, :name, :affiliation, :tshirt, :mobile, :volunteer_experience, :languages])
-              vchoice_ids: [], qanswer_ids: [], event_ids: [],
-              qanswers_attributes: [],
-              user_attributes: [
-                  :id, :name, :tshirt, :mobile, :volunteer_experience, :languages,
-                  :nickname, :affiliation])
     end
   end
 end

app/controllers/admin/rooms_controller.rb

@@ -47,7 +47,7 @@ module Admin
     private
 
     def room_params
-      params[:room]
+      params.require(:room).permit(:name, :size)
     end
   end
 end

app/controllers/admin/schedules_controller.rb

@@ -19,7 +19,7 @@ module Admin
 
     def update
       authorize! :update, @conference.events.new
-      event = Event.where(guid: params[:event]).first
+      event = Event.where(guid: event_params).first
       error_message = nil
       if event.nil?
         error_message = "Could not find event GUID: #{params[:event]}"
@@ -32,7 +32,7 @@ module Admin
         render json: { 'status' => 'ok' }
         return
       end
-      room = Room.where(guid: params[:room]).first
+      room = Room.where(guid: room_params).first
       if room.nil?
         error_message = "Could not find room GUID: #{params[:room]}"
       end
@@ -55,5 +55,15 @@ module Admin
       event.save!
       render json: { 'status' => 'ok' }
     end
+
+    private
+
+    def event_params
+      params.require(:event).permit(:guid)
+    end
+
+    def room_params
+      params.require(:room).permit(:guid)
+    end
   end
 end

app/controllers/admin/splashpages_controller.rb

@@ -43,7 +43,11 @@ module Admin
     private
 
     def splashpage_params
-      params[:splashpage]
+      params.require(:splashpage).permit(:public,
+                                         :include_tracks, :include_program, :include_cfp,
+                                         :include_venue, :include_registrations,
+                                         :include_tickets, :include_lodgings,
+                                         :include_sponsors, :include_social_media)
     end
   end
 end

app/controllers/admin/sponsors_controller.rb

@@ -49,7 +49,7 @@ module Admin
     private
 
     def sponsor_params
-      params[:sponsor]
+      params.require(:sponsor).permit(:name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id)
     end
   end
 end

app/controllers/admin/sponsorship_levels_controller.rb

@@ -59,7 +59,7 @@ module Admin
     private
 
     def sponsorship_level_params
-      params[:sponsorship_level]
+      params.require(:sponsorship_level).permit(:title, :conference_id)
     end
   end
 end

app/controllers/admin/targets_controller.rb

@@ -48,7 +48,7 @@ module Admin
     private
 
     def target_params
-      params[:target]
+      params.require(:target).permit(:due_date, :target_count, :unit, :conference_id)
     end
   end
 end

app/controllers/admin/tickets_controller.rb

@@ -48,7 +48,7 @@ module Admin
     private
 
     def ticket_params
-      params[:ticket]
+      params.require(:ticket).permit(:conference, :title, :url, :description, :conference_id, :price_cents, :price_currency, :price)
     end
   end
 end

app/controllers/admin/tracks_controller.rb

@@ -52,7 +52,7 @@ module Admin
     private
 
     def track_params
-      params[:track]
+      params.require(:track).permit(:name, :description, :color)
     end
   end
 end

app/controllers/admin/users_controller.rb

@@ -27,7 +27,7 @@ module Admin
         end
       end
 
-      if @user.update_attributes(params[:user])
+      if @user.update_attributes(user_params)
         redirect_to admin_users_path, notice: "Updated #{@user.name} (#{@user.email})!" + message
       else
         redirect_to admin_users_path, alert: "Could not update #{@user.name} (#{@user.email}). #{@user.errors.full_messages.join('. ')}."
@@ -35,5 +35,12 @@ module Admin
     end
 
     def edit; end
+
+    private
+
+    def user_params
+      params.require(:user).permit(:email, :name, :email_public, :biography, :nickname, :affiliation, :is_admin, :username, :login, :is_disabled,
+                                   :tshirt, :mobile, :volunteer_experience, :languages, role_ids: [])
+    end
   end
 end

app/controllers/admin/venues_controller.rb

@@ -44,7 +44,7 @@ module Admin
     private
 
     def venue_params
-      params[:venue]
+      params.require(:venue).permit(:name, :street, :postalcode, :city, :country, :longitude, :latitude, :description, :website, :photo, :lodgings_attributes, :conference_id)
     end
   end
 end

app/controllers/admin/volunteers_controller.rb

@@ -24,7 +24,7 @@ module Admin
 
     def update
       if can_manage_volunteers(@conference)
-        if @conference.update_attributes(params[:conference])
+        if @conference.update_attributes(conference_params)
           redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: 'Volunteering options were successfully updated.')
         else
           redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{@conference.errors.full_messages.join '. '}")
@@ -33,5 +33,11 @@ module Admin
         authorize! :index, :volunteer
       end
     end
+
+    private
+
+    def conference_params
+      params.require(:conference).permit!
+    end
   end
 end

app/controllers/commercials_controller.rb

@@ -46,7 +46,6 @@ class CommercialsController < ApplicationController
   end
 
   def commercial_params
-    #params.require(:commercial).permit(:commercial_id, :commercial_type)
+    params.require(:commercial).permit(:commercial_id, :commercial_type)
-    params[:commercial]
   end
 end

app/controllers/conference_controller.rb

@@ -28,9 +28,9 @@ class ConferenceController < ApplicationController
 
   private
 
-    def respond_to_options
+  def respond_to_options
-      respond_to do |format|
+    respond_to do |format|
-        format.html { head :ok }
+      format.html { head :ok }
-      end if request.options?
+    end if request.options?
-    end
+  end
 end

app/controllers/proposal_controller.rb

@@ -26,7 +26,7 @@ class ProposalController < ApplicationController
     @url = conference_proposal_index_path(@conference.short_title)
 
     unless current_user
-      @user = User.new(params[:user])
+      @user = User.new(user_params)
       if @user.save
         sign_in(@user)
       else
@@ -38,7 +38,7 @@ class ProposalController < ApplicationController
 
     params[:event].delete :user
 
-    @event = Event.new(params[:event])
+    @event = Event.new(event_params)
     @event.conference = @conference
 
     @event.event_users.new(user: current_user,
@@ -62,17 +62,7 @@ class ProposalController < ApplicationController
     authorize! :update, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
 
-    # First, update the submitter's info, if they've changed anything
+    if !@event.update(event_params)
-    current_user.assign_attributes(params[:user])
-    if current_user.changed?
-      current_user.save
-    end
-
-    # FIXME: Hmmmmm
-    params[:event].delete :users_attributes
-    params[:event].delete :user
-
-    if !@event.update(params[:event])
       flash[:error] = "Could not update proposal: #{@event.errors.full_messages.join(', ')}"
       render action: 'new'
       return
@@ -145,6 +135,16 @@ class ProposalController < ApplicationController
     redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
                 notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.")
   end
+
+  private
+
+  def event_params
+    params.require(:event).permit(:title, :subtitle, :event_type_id, :abstract, :description, :require_registration, :difficulty_level_id)
+  end
+
+  def user_params
+    params.require(:user).permit(:email, :password, :password_confirmation, :username)
+  end
 end
 
 # FIXME: Introduce strong_parameters pronto!

app/controllers/ticket_purchases_controller.rb

@@ -29,4 +29,10 @@ class TicketPurchasesController < ApplicationController
                         "#{@ticket_purchases.errors.full_messages.join('. ')}."
     end
   end
+
+  private
+
+  def ticket_purchase_params
+    params.require(:ticket_purchase).permit(:ticket_id, :user_id, :conference_id, :quantity)
+  end
 end

app/controllers/users_controller.rb

@@ -24,6 +24,6 @@ class UsersController < ApplicationController
 
     # Only allow a trusted parameter "white list" through.
     def user_params
-      params.require(:user).permit(:user_id, :name, :biography, :nickname, :affiliation)
+      params.require(:user).permit(:name, :biography, :nickname, :affiliation)
     end
 end

app/models/answer.rb

@@ -1,6 +1,4 @@
 class Answer < ActiveRecord::Base
-  attr_accessible :title
-
   has_many :qanswers
   has_many :questions, through: :qanswers
 

app/models/call_for_paper.rb

@@ -1,8 +1,5 @@
 class CallForPaper < ActiveRecord::Base
   belongs_to :conference
-  attr_accessible :start_date, :end_date,
-                  :schedule_changes, :rating,
-                  :schedule_public, :include_cfp_in_splash, :conference_id
 
   validates_presence_of :start_date, :end_date
   validates :rating, numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 10 }

app/models/campaign.rb

@@ -1,7 +1,4 @@
 class Campaign < ActiveRecord::Base
-  attr_accessible :name, :utm_source, :utm_medium, :utm_term,
-                  :utm_content, :utm_campaign, :target_ids, :conference_id
-
   validates :name, :utm_campaign, presence: true
 
   has_many :targets, dependent: :nullify

app/models/comment.rb

@@ -1,6 +1,5 @@
 class Comment < ActiveRecord::Base
   acts_as_nested_set scope: [:commentable_id, :commentable_type]
-  attr_accessible :commentable, :body, :user_id
   validates_presence_of :body
   validates_presence_of :user
   after_create :send_notification

app/models/commercial.rb

@@ -1,8 +1,6 @@
 class Commercial < ActiveRecord::Base
   belongs_to :commercialable, polymorphic: true
 
-  attr_accessible :commercial_id, :commercial_type
-
   validates :commercial_id, presence: true
   validates :commercial_type, presence: true
 

app/models/conference.rb

@@ -8,18 +8,6 @@ class Conference < ActiveRecord::Base
 
   default_scope { order('start_date DESC') }
 
-  attr_accessible :title, :short_title, :description, :timezone, :html_export_path,
-                  :start_date, :end_date, :rooms_attributes, :tracks_attributes,
-                  :dietary_choices_attributes, :use_dietary_choices,
-                  :tickets_attributes, :social_events_attributes, :event_types_attributes,
-                  :logo, :questions_attributes,
-                  :question_ids, :answers_attributes, :answer_ids, :difficulty_levels_attributes,
-                  :use_difficulty_levels, :use_vpositions, :use_vdays, :vdays_attributes,
-                  :vpositions_attributes, :use_volunteers, :color,
-                  :sponsorship_levels_attributes, :sponsors_attributes,
-                  :photos_attributes, :targets, :targets_attributes,
-                  :campaigns, :campaigns_attributes
-
   has_paper_trail
 
   has_and_belongs_to_many :questions

app/models/contact.rb

@@ -1,7 +1,4 @@
 class Contact < ActiveRecord::Base
-  attr_accessible :conference_id, :social_tag, :email, :facebook, :googleplus, :twitter,
-                  :instagram, :public, :sponsor_email
-
   belongs_to :conference
 
   validates :conference, presence: true

app/models/dietary_choice.rb

@@ -1,6 +1,4 @@
 class DietaryChoice < ActiveRecord::Base
-  attr_accessible :title
-
   belongs_to :conference
   has_many :registrations
 end

app/models/difficulty_level.rb

@@ -1,6 +1,4 @@
 class DifficultyLevel < ActiveRecord::Base
-  attr_accessible :title, :description, :color, :conference_id
-
   belongs_to :conference
   has_many :events, dependent: :nullify
 

app/models/email_settings.rb

@@ -1,14 +1,4 @@
 class EmailSettings < ActiveRecord::Base
-  attr_accessible :send_on_registration, :registration_subject, :registration_body,
-                  :send_on_accepted, :accepted_subject, :accepted_body,
-                  :send_on_rejected, :rejected_subject, :rejected_body,
-                  :send_on_confirmed_without_registration, :confirmed_without_registration_subject, :confirmed_without_registration_body,
-                  :send_on_conference_dates_updated, :conference_dates_updated_subject, :conference_dates_updated_body,
-                  :send_on_conference_registration_dates_updated, :conference_registration_dates_updated_subject, :conference_registration_dates_updated_body,
-                  :send_on_venue_updated, :venue_updated_subject, :venue_updated_body,
-                  :send_on_call_for_papers_dates_updated, :call_for_papers_dates_updated_subject, :call_for_papers_dates_updated_body,
-                  :send_on_call_for_papers_schedule_public, :call_for_papers_schedule_public_subject, :call_for_papers_schedule_public_body
-
   def get_values(conference, user, event = nil)
     h = {
       'email' => user.email,

app/models/event.rb

@@ -1,9 +1,6 @@
 class Event < ActiveRecord::Base
   include ActiveRecord::Transitions
   has_paper_trail
-  attr_accessible :title, :subtitle, :abstract, :description, :user, :users_attributes,
-                  :proposal_additional_speakers, :event_type_id, :track_id,
-                  :difficulty_level_id, :require_registration, :is_highlight
 
   acts_as_commentable
 

app/models/event_type.rb

@@ -1,7 +1,4 @@
 class EventType < ActiveRecord::Base
-  attr_accessible :title, :length, :minimum_abstract_length, :maximum_abstract_length, :color,
-                  :conference_id, :description
-
   belongs_to :conference
   has_many :events, dependent: :restrict_with_error
 

app/models/event_user.rb

@@ -1,5 +1,4 @@
 class EventUser < ActiveRecord::Base
-  attr_accessible :event, :user, :user_id, :event_role
   # TODO Do we need these roles?
   ROLES = [['Speaker', 'speaker'], ['Submitter', 'submitter'], ['Moderator', 'moderator']]
 

app/models/events_registration.rb

@@ -1,6 +1,4 @@
 class EventsRegistration < ActiveRecord::Base
-  attr_accessible :registration_id, :event_id
-
   belongs_to :registration
   belongs_to :event
 end

app/models/lodging.rb

@@ -1,5 +1,4 @@
 class Lodging < ActiveRecord::Base
-  attr_accessible :name, :description, :photo, :website_link, :conference_id
   belongs_to :conference
 
   validates :name, presence: true

app/models/photo.rb

@@ -1,5 +1,4 @@
 class Photo < ActiveRecord::Base
-  attr_accessible :picture, :description
   belongs_to :conference
   validates_presence_of :picture
   has_attached_file :picture,

app/models/qanswer.rb

@@ -1,6 +1,4 @@
 class Qanswer < ActiveRecord::Base
-  attr_accessible :question_id, :answer_id
-
   belongs_to :question
   belongs_to :answer, dependent: :delete
 

app/models/question.rb

@@ -1,6 +1,4 @@
 class Question < ActiveRecord::Base
-  attr_accessible :title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id
-
   belongs_to :question_type
   has_and_belongs_to_many :conferences
 

app/models/question_type.rb

@@ -1,5 +1,3 @@
 class QuestionType < ActiveRecord::Base
-  attr_accessible :title, :description
-
   has_many :questions
 end

app/models/registration.rb

@@ -11,10 +11,6 @@ class Registration < ActiveRecord::Base
   has_many :events_registrations
   has_many :workshops, through: :events_registrations, source: :event
 
-  attr_accessible :user_id, :conference_id, :arrival, :departure, :user_attributes, :attended,
-                  :other_dietary_choice, :dietary_choice_id, :social_event_ids, :other_special_needs,
-                  :event_ids, :volunteer, :vchoice_ids, :qanswer_ids, :qanswers_attributes
-
   accepts_nested_attributes_for :user
   accepts_nested_attributes_for :social_events
   accepts_nested_attributes_for :qanswers

app/models/registration_period.rb

@@ -1,6 +1,4 @@
 class RegistrationPeriod < ActiveRecord::Base
-  attr_accessible :description, :start_date, :end_date
-
   validates :start_date, :end_date, presence: true
 
   belongs_to :conference

app/models/role.rb

@@ -1,5 +1,4 @@
 class Role < ActiveRecord::Base
-  attr_accessible :name, :description
   has_and_belongs_to_many :users
   belongs_to :resource, polymorphic: true
 

app/models/room.rb

@@ -1,6 +1,4 @@
 class Room < ActiveRecord::Base
-  attr_accessible :name, :size, :conference_id
-
   belongs_to :conference
   has_many :events, dependent: :nullify
 

app/models/social_event.rb

@@ -1,6 +1,4 @@
 class SocialEvent < ActiveRecord::Base
-  attr_accessible :title, :description, :date
-
   belongs_to :conference
   has_and_belongs_to_many :registrations
 end

app/models/splashpage.rb

@@ -1,8 +1,3 @@
 class Splashpage < ActiveRecord::Base
   belongs_to :conference
-  attr_accessible :public,
-                  :include_tracks, :include_program, :include_cfp,
-                  :include_venue, :include_registrations,
-                  :include_tickets, :include_lodgings,
-                  :include_sponsors, :include_social_media
 end

app/models/sponsor.rb

@@ -1,5 +1,4 @@
 class Sponsor < ActiveRecord::Base
-  attr_accessible :name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id
   belongs_to :sponsorship_level
   belongs_to :conference
   has_attached_file :logo,

app/models/sponsorship_level.rb

@@ -1,5 +1,4 @@
 class SponsorshipLevel < ActiveRecord::Base
-  attr_accessible :title, :conference_id
   validates_presence_of :title
   belongs_to :conference
   acts_as_list scope: :conference

app/models/subscription.rb

@@ -1,5 +1,4 @@
 class Subscription < ActiveRecord::Base
-  attr_accessible :user_id, :conference_id
   validates_uniqueness_of :user_id, scope: [:conference_id]
   belongs_to :conference
   belongs_to :user

app/models/target.rb

@@ -1,8 +1,6 @@
 class Target < ActiveRecord::Base
   include ActionView::Helpers::TextHelper
 
-  attr_accessible :due_date, :target_count, :unit, :conference_id
-
   default_scope { order('due_date ASC') }
 
   def self.units

app/models/ticket.rb

@@ -3,7 +3,6 @@ class Ticket < ActiveRecord::Base
   has_many :ticket_purchases, dependent: :destroy
   has_many :buyers, -> { distinct }, through: :ticket_purchases, source: :user
 
-  attr_accessible :conference, :title, :url, :description, :conference_id, :price_cents, :price_currency, :price
   monetize :price_cents, with_model_currency: :price_currency
 
   # This validation is for the sake of simplicity.

app/models/ticket_purchase.rb

@@ -3,8 +3,6 @@ class TicketPurchase < ActiveRecord::Base
   belongs_to :user
   belongs_to :conference
 
-  attr_accessible :ticket_id, :user_id, :conference_id, :paid, :quantity
-
   validates :ticket_id, :user_id, :conference_id, :quantity, presence: true
 
   validates_numericality_of :quantity, greater_than: 0

app/models/track.rb

@@ -1,5 +1,4 @@
 class Track < ActiveRecord::Base
-  attr_accessible :name, :description, :color, :conference_id
   belongs_to :conference
   has_many :events, dependent: :nullify
 

app/models/user.rb

@@ -32,10 +32,6 @@ class User < ActiveRecord::Base
   has_and_belongs_to_many :roles
   has_many :openids
 
-  attr_accessible :email, :password, :password_confirmation, :remember_me, :role_id, :role_ids,
-                  :name, :email_public, :biography, :nickname, :affiliation, :is_admin,
-                  :tshirt, :mobile, :volunteer_experience, :languages, :username, :login, :is_disabled
-
   attr_accessor :login
 
   has_many :event_users, dependent: :destroy

app/models/vday.rb

@@ -1,6 +1,4 @@
 class Vday < ActiveRecord::Base
-  attr_accessible :day, :description
-
   belongs_to :conference
 
   has_many :vchoices

app/models/venue.rb

@@ -3,7 +3,6 @@ class Venue < ActiveRecord::Base
   has_many :lodgings
   before_create :generate_guid
 
-  attr_accessible :name, :street, :postalcode, :city, :country, :longitude, :latitude, :description, :website, :photo, :lodgings_attributes, :conference_id
   validates :name, :street, :city, :country, presence: true
 
   has_attached_file :photo,

app/models/vote.rb

@@ -1,6 +1,4 @@
 class Vote < ActiveRecord::Base
-  attr_accessible :rating
-
   belongs_to :user
   belongs_to :event
   delegate :name, to: :user

app/models/vposition.rb

@@ -1,6 +1,4 @@
 class Vposition < ActiveRecord::Base
-  attr_accessible :title, :description, :vday_ids
-
   belongs_to :conference
 
   has_many :vchoices

app/views/conference/_all_events.html.erb

@@ -16,4 +16,4 @@
           <%= link_to 'more', conference_proposal_path(@conference.short_title, event.id) if event.abstract.length > 400 %>
         </p>
     </div>
-<% end %>
+<% end %>

config/application.rb

@@ -53,7 +53,7 @@ module Osem
     # This will create an empty whitelist of attributes available for mass-assignment for all models
     # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
     # parameters by using an attr_accessible or attr_protected declaration.
-    config.active_record.whitelist_attributes = true
+    # config.active_record.whitelist_attributes = true
 
     # Enable the asset pipeline
     config.assets.enabled = true

config/environments/development.rb

@@ -23,7 +23,7 @@ Osem::Application.configure do
   config.action_dispatch.best_standards_support = :builtin
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Do not compress assets
   config.assets.compress = false

config/environments/test.rb

@@ -30,7 +30,7 @@ Osem::Application.configure do
   config.action_mailer.delivery_method = :test
 
   # Raise exception on mass assignment protection for Active Record models
-  config.active_record.mass_assignment_sanitizer = :strict
+  # config.active_record.mass_assignment_sanitizer = :strict
 
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr

db/migrate/20140731165107_move_conference_contact_details_to_contact.rb

@@ -5,7 +5,6 @@ class MoveConferenceContactDetailsToContact < ActiveRecord::Migration
 
   class TempContact < ActiveRecord::Base
     self.table_name = 'contacts'
-    attr_accessible :conference_id, :social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public
   end
 
   def change

db/migrate/20140801164901_move_conference_media_to_commercial.rb

@@ -5,7 +5,6 @@ class MoveConferenceMediaToCommercial < ActiveRecord::Migration
 
   class TempCommercial < ActiveRecord::Base
     self.table_name = 'commercials'
-    attr_accessible :commercial_id, :commercial_type, :commercialable_id, :commercialable_type
   end
 
   def change

db/migrate/20140801170430_move_event_media_to_commercial.rb

@@ -5,7 +5,6 @@ class MoveEventMediaToCommercial < ActiveRecord::Migration
 
   class TempCommercial < ActiveRecord::Base
     self.table_name = 'commercials'
-    attr_accessible :commercial_id, :commercial_type, :commercialable_id, :commercialable_type
   end
 
   def change

db/migrate/20140812065531_move_conference_registration_data_to_registration_periods.rb

@@ -5,7 +5,6 @@ class MoveConferenceRegistrationDataToRegistrationPeriods < ActiveRecord::Migrat
 
   class TempRegistrationPeriod < ActiveRecord::Base
     self.table_name = 'registration_periods'
-    attr_accessible :conference_id, :start_date, :end_date, :description
   end
 
   def up

db/migrate/20140820093735_migrating_supporter_registrations_to_ticket_users.rb

@@ -1,17 +1,14 @@
 class MigratingSupporterRegistrationsToTicketUsers < ActiveRecord::Migration
   class TempSupporterRegistrations < ActiveRecord::Base
     self.table_name = 'supporter_registrations'
-    attr_accessible :conference_id, :supporter_level_id, :registration_id, :user_id
   end
 
   class TempUser < ActiveRecord::Base
     self.table_name = 'users'
-    attr_accessible :user_id
   end
 
   class TempRegistration < ActiveRecord::Base
     self.table_name = 'registrations'
-    attr_accessible :user_id
   end
 
   def change

db/migrate/20140820123503_assign_users_to_events.rb

@@ -5,14 +5,12 @@ class AssignUsersToEvents < ActiveRecord::Migration
 
   class TempUser < ActiveRecord::Base
     self.table_name = 'users'
-    attr_accessible :email, :name, :biography, :password
   end
 
   class TempEventUser < ActiveRecord::Base
     self.table_name = 'event_users'
     belongs_to :temp_event
     belongs_to :temp_user
-    attr_accessible :event_id, :user_id, :event_role
   end
 
   def up

db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb

@@ -11,7 +11,6 @@ class UndoWrongMigration20140801080705AddUsersToEvents < ActiveRecord::Migration
     self.table_name = 'event_users'
     belongs_to :temp_event
     belongs_to :temp_user
-    attr_accessible :event_id, :user_id, :event_role
   end
 
   class Version < ActiveRecord::Base

db/migrate/20140821103643_split_ticket_price_in_price_and_currency.rb

@@ -1,7 +1,6 @@
 class SplitTicketPriceInPriceAndCurrency < ActiveRecord::Migration
   class TempTicket < ActiveRecord::Base
     self.table_name = 'tickets'
-    attr_accessible :ticket_price, :price_cents, :price_currency
   end
 
   def change

db/migrate/20140825093132_move_splashpage_attributes_from_conference_to_splashpage.rb

@@ -17,10 +17,6 @@ class MoveSplashpageAttributesFromConferenceToSplashpage < ActiveRecord::Migrati
 
   class TempSplashpage < ActiveRecord::Base
     self.table_name = 'splashpages'
-    attr_accessible :conference_id, :public, :include_registrations, :include_tracks, :include_program,
-                    :include_social_media, :include_banner, :include_tickets, :ticket_description, :include_sponsors,
-                    :sponsor_description, :lodging_description, :banner_photo_file_name, :banner_photo_content_type,
-                    :banner_photo_file_size, :banner_photo_updated_at, :banner_description
   end
 
   def change

db/migrate/20141031225545_add_require_handicapped_access_to_questions.rb

@@ -3,7 +3,6 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration
     self.table_name = 'registrations'
 
     belongs_to :temp_conference
-    attr_accessible :handicapped_access_required
   end
 
   class TempConference < ActiveRecord::Base
@@ -16,14 +15,12 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration
   class TempQuestionType < ActiveRecord::Base
     self.table_name = 'question_types'
 
-    attr_accessible :title
     has_many :temp_questions
   end
 
   class TempQuestion < ActiveRecord::Base
     self.table_name = 'questions'
 
-    attr_accessible :title, :global, :question_type_id
     has_many :temp_qanswers
     has_many :temp_answers, through: :temp_qanswers
     belongs_to :temp_question_type
@@ -33,7 +30,6 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration
   class TempAnswer < ActiveRecord::Base
     self.table_name = 'answers'
 
-    attr_accessible :title
     has_many :temp_qanswers
     has_many :temp_questions, through: :temp_qanswers
   end
@@ -41,21 +37,16 @@ class AddRequireHandicappedAccessToQuestions < ActiveRecord::Migration
   class TempQanswer < ActiveRecord::Base
     self.table_name = 'qanswers'
 
-    attr_accessible :question_id, :answer_id
     belongs_to :temp_question
     belongs_to :temp_answer
   end
 
   class TempConferencesQuestions < ActiveRecord::Base
     self.table_name = 'conferences_questions'
-
-    attr_accessible :question_id, :conference_id
   end
 
   class TempQanswerRegistration < ActiveRecord::Base
     self.table_name = 'qanswers_registrations'
-
-    attr_accessible :registration_id, :qanswer_id
   end
 
   def change

db/migrate/20141031225606_add_attending_with_partner_to_questions.rb

@@ -3,7 +3,6 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration
     self.table_name = 'registrations'
 
     belongs_to :temp_conference
-    attr_accessible :attending_with_partner
   end
 
   class TempConference < ActiveRecord::Base
@@ -16,14 +15,12 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration
   class TempQuestionType < ActiveRecord::Base
     self.table_name = 'question_types'
 
-    attr_accessible :title
     has_many :temp_questions
   end
 
   class TempQuestion < ActiveRecord::Base
     self.table_name = 'questions'
 
-    attr_accessible :title, :global, :question_type_id
     has_many :temp_qanswers
     has_many :temp_answers, through: :temp_qanswers
     belongs_to :temp_question_type
@@ -33,7 +30,6 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration
   class TempAnswer < ActiveRecord::Base
     self.table_name = 'answers'
 
-    attr_accessible :title
     has_many :temp_qanswers
     has_many :temp_questions, through: :temp_qanswers
   end
@@ -41,21 +37,16 @@ class AddAttendingWithPartnerToQuestions < ActiveRecord::Migration
   class TempQanswer < ActiveRecord::Base
     self.table_name = 'qanswers'
 
-    attr_accessible :question_id, :answer_id
     belongs_to :temp_question
     belongs_to :temp_answer
   end
 
   class TempConferencesQuestions < ActiveRecord::Base
     self.table_name = 'conferences_questions'
-
-    attr_accessible :question_id, :conference_id
   end
 
   class TempQanswerRegistration < ActiveRecord::Base
     self.table_name = 'qanswers_registrations'
-
-    attr_accessible :registration_id, :qanswer_id
   end
 
   def change

db/migrate/20141031225620_add_staying_at_suggested_hotel_to_questions.rb

@@ -3,7 +3,6 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration
     self.table_name = 'registrations'
 
     belongs_to :temp_conference
-    attr_accessible :using_affiliated_lodging
   end
 
   class TempConference < ActiveRecord::Base
@@ -16,14 +15,12 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration
   class TempQuestionType < ActiveRecord::Base
     self.table_name = 'question_types'
 
-    attr_accessible :title
     has_many :temp_questions
   end
 
   class TempQuestion < ActiveRecord::Base
     self.table_name = 'questions'
 
-    attr_accessible :title, :global, :question_type_id
     has_many :temp_qanswers
     has_many :temp_answers, through: :temp_qanswers
     belongs_to :temp_question_type
@@ -33,7 +30,6 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration
   class TempAnswer < ActiveRecord::Base
     self.table_name = 'answers'
 
-    attr_accessible :title
     has_many :temp_qanswers
     has_many :temp_questions, through: :temp_qanswers
   end
@@ -41,21 +37,16 @@ class AddStayingAtSuggestedHotelToQuestions < ActiveRecord::Migration
   class TempQanswer < ActiveRecord::Base
     self.table_name = 'qanswers'
 
-    attr_accessible :question_id, :answer_id
     belongs_to :temp_question
     belongs_to :temp_answer
   end
 
   class TempConferencesQuestions < ActiveRecord::Base
     self.table_name = 'conferences_questions'
-
-    attr_accessible :question_id, :conference_id
   end
 
   class TempQanswerRegistration < ActiveRecord::Base
     self.table_name = 'qanswers_registrations'
-
-    attr_accessible :registration_id, :qanswer_id
   end
 
   def change

db/migrate/20141031225635_add_attending_social_events_to_questions.rb

@@ -2,7 +2,6 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration
   class TempRegistration < ActiveRecord::Base
     self.table_name = 'registrations'
 
-    attr_accessible :attending_social_events
     belongs_to :temp_conference
   end
 
@@ -16,14 +15,12 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration
   class TempQuestionType < ActiveRecord::Base
     self.table_name = 'question_types'
 
-    attr_accessible :title
     has_many :temp_questions
   end
 
   class TempQuestion < ActiveRecord::Base
     self.table_name = 'questions'
 
-    attr_accessible :title, :global, :question_type_id
     has_many :temp_qanswers
     has_many :temp_answers, through: :temp_qanswers
     belongs_to :temp_question_type
@@ -33,7 +30,6 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration
   class TempAnswer < ActiveRecord::Base
     self.table_name = 'answers'
 
-    attr_accessible :title
     has_many :temp_qanswers
     has_many :temp_questions, through: :temp_qanswers
   end
@@ -41,21 +37,16 @@ class AddAttendingSocialEventsToQuestions < ActiveRecord::Migration
   class TempQanswer < ActiveRecord::Base
     self.table_name = 'qanswers'
 
-    attr_accessible :question_id, :answer_id
     belongs_to :temp_question
     belongs_to :temp_answer
   end
 
   class TempConferencesQuestions < ActiveRecord::Base
     self.table_name = 'conferences_questions'
-
-    attr_accessible :question_id, :conference_id
   end
 
   class TempQanswerRegistration < ActiveRecord::Base
     self.table_name = 'qanswers_registrations'
-
-    attr_accessible :registration_id, :qanswer_id
   end
 
   def change

db/migrate/20141104131625_generate_username.rb

@@ -1,7 +1,6 @@
 class GenerateUsername < ActiveRecord::Migration
   class TempUser < ActiveRecord::Base
     self.table_name = 'users'
-    attr_accessible :username, :email
   end
 
   def change

db/migrate/20141117214230_move_banner_description_to_conference.rb

@@ -1,7 +1,6 @@
 class MoveBannerDescriptionToConference < ActiveRecord::Migration
   class TempConference < ActiveRecord::Base
     self.table_name = 'conferences'
-    attr_accessible :description
   end
 
   class TempSplashpage < ActiveRecord::Base

db/migrate/20141118153918_change_venue_conference_association.rb

@@ -5,7 +5,6 @@ class ChangeVenueConferenceAssociation < ActiveRecord::Migration
 
   class TempVenue < ActiveRecord::Base
     self.table_name = 'venues'
-    attr_accessible :conference_id
   end
 
   def change

db/migrate/20141118162030_change_lodging_association_to_conference.rb

@@ -9,7 +9,6 @@ class ChangeLodgingAssociationToConference < ActiveRecord::Migration
 
   class TempLodging < ActiveRecord::Base
     self.table_name = 'lodgings'
-    attr_accessible :conference_id
   end
 
   def change

db/migrate/20141128073306_migrate_data_remove_column_include_cfp_in_splash_add_column_include_cfp.rb

@@ -9,7 +9,6 @@ class MigrateDataRemoveColumnIncludeCfpInSplashAddColumnIncludeCfp < ActiveRecor
 
   class TempSplashpage < ActiveRecord::Base
     self.table_name = 'splashpages'
-    attr_accessible :conference_id
   end
 
   def up

spec/controllers/admin/registration_periods_controller_spec.rb

@@ -22,7 +22,7 @@ describe Admin::RegistrationPeriodsController do
       context 'valid attributes' do
 
         it 'locates the requested registration period object' do
-          patch :update, conference_id: conference.short_title, conference: attributes_for(:registration_period)
+          patch :update, conference_id: conference.short_title, registration_period: attributes_for(:registration_period)
           expect(assigns(:registration_period)).to eq(conference.registration_period)
         end
 

spec/controllers/admin/users_controller_spec.rb

@@ -20,18 +20,19 @@ describe Admin::UsersController do
   end
   describe 'PATCH #update' do
     context 'valid attributes' do
+      before :each do
+        patch :update, id: user.id, user: { name: 'new name', email: 'new_email@osem.io' }
+      end
+
       it 'locates requested @user' do
-        patch :update, id: user.id
         expect(build(:user, id: user.id)).to eq(user)
       end
       it 'changes @users attributes' do
-        patch :update, id: user.id
         expect(build(
-          :user, email: 'new@email.osem', id: user.id).email).
+          :user, email: 'email_new@osem.io', id: user.id).email).
-              to eq('new@email.osem')
+              to eq('email_new@osem.io')
       end
       it 'redirects to the updated user' do
-        patch :update, id: user.id
         expect(response).to redirect_to admin_users_path
       end
     end

spec/features/ability_spec.rb

@@ -2,11 +2,11 @@ require 'spec_helper'
 
 feature 'Has correct abilities' do
   # It is necessary to use bang version of let to build roles before user
-  let(:conference1) { create(:conference, venue: create(:venue)) } # user is organizer
+  let(:conference1) { create(:conference) } # user is organizer
-  let(:conference2) { create(:conference, venue: create(:venue)) } # user is cfp
+  let(:conference2) { create(:conference) } # user is cfp
-  let(:conference3) { create(:conference, venue: create(:venue)) } # user is info_desk
+  let(:conference3) { create(:conference) } # user is info_desk
-  let(:conference4) { create(:conference, venue: create(:venue)) } # user is volunteer coordinator
+  let(:conference4) { create(:conference) } # user is volunteer coordinator
-  let(:conference5) { create(:conference, venue: create(:venue)) } # user has no role
+  let(:conference5) { create(:conference) } # user has no role
 
   let(:role_organizer) { create(:role, name: 'organizer', resource: conference1) }
   let(:role_cfp) { create(:role, name: 'cfp', resource: conference2) }
@@ -77,6 +77,10 @@ feature 'Has correct abilities' do
     visit admin_conference_targets_path(conference1.short_title)
     expect(current_path).to eq(admin_conference_targets_path(conference1.short_title))
 
+    visit new_admin_conference_venue_path(conference1.short_title)
+    expect(current_path).to eq(new_admin_conference_venue_path(conference1.short_title))
+
+    conference1.venue = create(:venue)
     visit edit_admin_conference_venue_path(conference1.short_title)
     expect(current_path).to eq(edit_admin_conference_venue_path(conference1.short_title))