From 98ba075c327c20f84bb465907ff1d954538e0e39 Mon Sep 17 00:00:00 2001
From: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Date: Thu, 26 Jun 2014 15:11:45 +0300
Subject: [PATCH] User model to strong params. Comment other attr_accessible to
let tests run
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
---
app/controllers/admin/users_controller.rb | 23 +++++++++++++------
.../profiles/passwords_controller.rb | 12 ++++++----
app/controllers/profiles_controller.rb | 14 ++++++++---
app/models/email.rb | 8 -------
app/models/event.rb | 4 ++--
app/models/group.rb | 2 +-
app/models/namespace.rb | 2 +-
app/models/note.rb | 4 ++--
app/models/project_hook.rb | 2 +-
app/models/snippet.rb | 2 +-
app/models/user.rb | 12 ----------
app/models/users_project.rb | 2 +-
app/models/web_hook.rb | 2 +-
13 files changed, 45 insertions(+), 44 deletions(-)
diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index f0040bf5e87..85dce0db8f2 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -37,14 +37,14 @@ class Admin::UsersController < Admin::ApplicationController
end
def create
- admin = params[:user].delete("admin")
+ admin = user_params.delete("admin")
opts = {
force_random_password: true,
password_expires_at: Time.now
}
- @user = User.build_user(params[:user].merge(opts), as: :admin)
+ @user = User.build_user(user_params.merge(opts), as: :admin)
@user.admin = (admin && admin.to_i > 0)
@user.created_by_id = current_user.id
@user.generate_password
@@ -62,11 +62,11 @@ class Admin::UsersController < Admin::ApplicationController
end
def update
- admin = params[:user].delete("admin")
+ admin = user_params.delete("admin")
- if params[:user][:password].blank?
- params[:user].delete(:password)
- params[:user].delete(:password_confirmation)
+ if user_params[:password].blank?
+ user_params.delete(:password)
+ user_params.delete(:password_confirmation)
end
if admin.present?
@@ -74,7 +74,7 @@ class Admin::UsersController < Admin::ApplicationController
end
respond_to do |format|
- if user.update_attributes(params[:user], as: :admin)
+ if user.update_attributes(user_params, as: :admin)
user.confirm!
format.html { redirect_to [:admin, user], notice: 'User was successfully updated.' }
format.json { head :ok }
@@ -115,4 +115,13 @@ class Admin::UsersController < Admin::ApplicationController
def user
@user ||= User.find_by!(username: params[:id])
end
+
+ def user_params
+ params.require(:user).permit(
+ :email, :password, :password_confirmation, :remember_me, :bio, :name, :username,
+ :skype, :linkedin, :twitter, :website_url, :color_scheme_id, :theme_id, :force_random_password,
+ :extern_uid, :provider, :password_expires_at, :avatar, :hide_no_ssh_key,
+ :projects_limit, :can_create_group,
+ )
+ end
end
diff --git a/app/controllers/profiles/passwords_controller.rb b/app/controllers/profiles/passwords_controller.rb
index df6954554ea..60617e4f8ae 100644
--- a/app/controllers/profiles/passwords_controller.rb
+++ b/app/controllers/profiles/passwords_controller.rb
@@ -11,8 +11,8 @@ class Profiles::PasswordsController < ApplicationController
end
def create
- new_password = params[:user][:password]
- new_password_confirmation = params[:user][:password_confirmation]
+ new_password = user_params[:password]
+ new_password_confirmation = user_params[:password_confirmation]
result = @user.update_attributes(
password: new_password,
@@ -31,11 +31,11 @@ class Profiles::PasswordsController < ApplicationController
end
def update
- password_attributes = params[:user].select do |key, value|
+ password_attributes = user_params.select do |key, value|
%w(password password_confirmation).include?(key.to_s)
end
- unless @user.valid_password?(params[:user][:current_password])
+ unless @user.valid_password?(user_params[:current_password])
redirect_to edit_profile_password_path, alert: 'You must provide a valid current password'
return
end
@@ -74,4 +74,8 @@ class Profiles::PasswordsController < ApplicationController
def authorize_change_password!
return render_404 if @user.ldap_user?
end
+
+ def user_params
+ params.require(:user).permit(:password, :password_confirmation)
+ end
end
diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb
index 9c9a129b26b..f7c9651d050 100644
--- a/app/controllers/profiles_controller.rb
+++ b/app/controllers/profiles_controller.rb
@@ -14,9 +14,9 @@ class ProfilesController < ApplicationController
end
def update
- params[:user].delete(:email) if @user.ldap_user?
+ user_params.delete(:email) if @user.ldap_user?
- if @user.update_attributes(params[:user])
+ if @user.update_attributes(user_params)
flash[:notice] = "Profile was successfully updated"
else
flash[:alert] = "Failed to update profile"
@@ -41,7 +41,7 @@ class ProfilesController < ApplicationController
end
def update_username
- @user.update_attributes(username: params[:user][:username])
+ @user.update_attributes(username: user_params[:username])
respond_to do |format|
format.js
@@ -57,4 +57,12 @@ class ProfilesController < ApplicationController
def authorize_change_username!
return render_404 unless @user.can_change_username?
end
+
+ def user_params
+ params.require(:user).permit(
+ :email, :password, :password_confirmation, :bio, :name, :username,
+ :skype, :linkedin, :twitter, :website_url, :color_scheme_id, :theme_id,
+ :avatar, :hide_no_ssh_key,
+ )
+ end
end
diff --git a/app/models/email.rb b/app/models/email.rb
index 9068c2b87b6..57f476bd519 100644
--- a/app/models/email.rb
+++ b/app/models/email.rb
@@ -10,16 +10,8 @@
#
class Email < ActiveRecord::Base
- attr_accessible :email, :user_id
-
- #
- # Relations
- #
belongs_to :user
- #
- # Validations
- #
validates :user_id, presence: true
validates :email, presence: true, email: { strict_mode: true }, uniqueness: true
validate :unique_email, if: ->(email) { email.email_changed? }
diff --git a/app/models/event.rb b/app/models/event.rb
index 1a8d55c54b4..487ea7666e5 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -15,8 +15,8 @@
#
class Event < ActiveRecord::Base
- attr_accessible :project, :action, :data, :author_id, :project_id,
- :target_id, :target_type
+ #attr_accessible :project, :action, :data, :author_id, :project_id,
+ #:target_id, :target_type
default_scope { where.not(author_id: nil) }
diff --git a/app/models/group.rb b/app/models/group.rb
index e51e19ab60c..671b5611a71 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -20,7 +20,7 @@ class Group < Namespace
has_many :users_groups, dependent: :destroy
has_many :users, through: :users_groups
- attr_accessible :avatar
+ #attr_accessible :avatar
validate :avatar_type, if: ->(user) { user.avatar_changed? }
validates :avatar, file_size: { maximum: 100.kilobytes.to_i }
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 446e5f04c63..524fd9e0c4c 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -16,7 +16,7 @@
class Namespace < ActiveRecord::Base
include Gitlab::ShellAdapter
- attr_accessible :name, :description, :path
+ #attr_accessible :name, :description, :path
has_many :projects, dependent: :destroy
belongs_to :owner, class_name: "User"
diff --git a/app/models/note.rb b/app/models/note.rb
index 94d45aa43db..d17cddb0bd1 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -25,8 +25,8 @@ class Note < ActiveRecord::Base
default_value_for :system, false
- attr_accessible :note, :noteable, :noteable_id, :noteable_type, :project_id,
- :attachment, :line_code, :commit_id
+ #attr_accessible :note, :noteable, :noteable_id, :noteable_type, :project_id,
+ #:attachment, :line_code, :commit_id
attr_mentionable :note
belongs_to :project
diff --git a/app/models/project_hook.rb b/app/models/project_hook.rb
index 6db6767a88d..ffede4c7025 100644
--- a/app/models/project_hook.rb
+++ b/app/models/project_hook.rb
@@ -18,7 +18,7 @@
class ProjectHook < WebHook
belongs_to :project
- attr_accessible :push_events, :issues_events, :merge_requests_events, :tag_push_events
+ #attr_accessible :push_events, :issues_events, :merge_requests_events, :tag_push_events
scope :push_hooks, -> { where(push_events: true) }
scope :tag_push_hooks, -> { where(tag_push_events: true) }
diff --git a/app/models/snippet.rb b/app/models/snippet.rb
index 9e4409daa1a..958697f70cd 100644
--- a/app/models/snippet.rb
+++ b/app/models/snippet.rb
@@ -18,7 +18,7 @@
class Snippet < ActiveRecord::Base
include Linguist::BlobHelper
- attr_accessible :title, :content, :file_name, :expires_at, :private
+ #attr_accessible :title, :content, :file_name, :expires_at, :private
default_value_for :private, true
diff --git a/app/models/user.rb b/app/models/user.rb
index 63d819a0f36..6ce57f086bc 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -58,23 +58,11 @@ class User < ActiveRecord::Base
devise :database_authenticatable, :token_authenticatable, :lockable, :async,
:recoverable, :rememberable, :trackable, :validatable, :omniauthable, :confirmable, :registerable
- attr_accessible :email, :password, :password_confirmation, :remember_me, :bio, :name, :username,
- :skype, :linkedin, :twitter, :website_url, :color_scheme_id, :theme_id, :force_random_password,
- :extern_uid, :provider, :password_expires_at, :avatar, :hide_no_ssh_key,
- as: [:default, :admin]
-
- attr_accessible :projects_limit, :can_create_group,
- as: :admin
-
attr_accessor :force_random_password
# Virtual attribute for authenticating by either username or email
attr_accessor :login
- # Add login to attr_accessible
- attr_accessible :login
-
-
#
# Relations
#
diff --git a/app/models/users_project.rb b/app/models/users_project.rb
index 6495bed4e61..409282ec818 100644
--- a/app/models/users_project.rb
+++ b/app/models/users_project.rb
@@ -16,7 +16,7 @@ class UsersProject < ActiveRecord::Base
include Notifiable
include Gitlab::Access
- attr_accessible :user, :user_id, :project_access
+ #attr_accessible :user, :user_id, :project_access
belongs_to :user
belongs_to :project
diff --git a/app/models/web_hook.rb b/app/models/web_hook.rb
index 76854da5c38..7a48dcdc272 100644
--- a/app/models/web_hook.rb
+++ b/app/models/web_hook.rb
@@ -22,7 +22,7 @@ class WebHook < ActiveRecord::Base
default_value_for :issues_events, false
default_value_for :merge_requests_events, false
- attr_accessible :url
+ #attr_accessible :url
# HTTParty timeout
default_timeout 10
--
GitLab