community_engine 2.3.2 → 3.0.0

data/app/controllers/ads_controller.rb

@@ -2,13 +2,18 @@ class AdsController < BaseController
   
   before_filter :login_required
   before_filter :admin_required  
+  
+  uses_tiny_mce do
+    {:only => [:new, :edit, :create, :update], :options => configatron.default_mce_options}
+  end
 
   # GET /ads
   # GET /ads.xml
   def index
-    @search = Ad.search(params[:search])
-    @search.meta_sort ||= 'created_at.desc'    
-    @ads = @search.page(params[:page]).per(15)
+    @search = Ad.search(params[:q])
+    @result = @search.result
+    @ads = @result.order('created_at DESC').distinct
+    @ads = @result.page(params[:page]).per(15)
 
     respond_to do |format|
       format.html
@@ -38,7 +43,7 @@ class AdsController < BaseController
   # POST /ads
   # POST /ads.xml
   def create
-    @ad = Ad.new(params[:ad])
+    @ad = Ad.new(ad_params)
 
     respond_to do |format|
       if @ad.save
@@ -56,7 +61,7 @@ class AdsController < BaseController
     @ad = Ad.find(params[:id])
 
     respond_to do |format|
-      if @ad.update_attributes(params[:ad])
+      if @ad.update_attributes(ad_params)
         flash[:notice] = :ad_was_successfully_updated.l
         format.html { redirect_to ad_url(@ad) }
       else
@@ -76,4 +81,10 @@ class AdsController < BaseController
       format.xml  { head :ok }
     end
   end
+
+  private
+
+  def ad_params
+    params[:ad].permit(:html, :name, :frequency, :audience, :published, :time_constrained, :start_date, :end_date, :location)
+  end
 end

data/app/controllers/albums_controller.rb

@@ -27,7 +27,7 @@ class AlbumsController < BaseController
   # GET /albums/new
   # GET /albums/new.xml
   def new
-    @album = Album.new(params[:album])
+    @album = Album.new
 
     respond_to do |format|
       format.html # new.html.erb
@@ -43,7 +43,7 @@ class AlbumsController < BaseController
   # POST /albums
   # POST /albums.xml
   def create
-    @album = Album.new(params[:album])
+    @album = Album.new(album_params)
     @album.user_id = current_user.id
     
     respond_to do |format|
@@ -60,13 +60,13 @@ class AlbumsController < BaseController
     end
   end
 
-  # PUT /albums/1
-  # PUT /albums/1.xml
+  # patch /albums/1
+  # patch /albums/1.xml
   def update
     @album = Album.find(params[:id])
 
     respond_to do |format|
-      if @album.update_attributes(params[:album])
+      if @album.update_attributes(album_params)
         if params[:go_to] == 'only_create'
           flash[:notice] = :album_updated.l
           format.html { redirect_to(user_album_path(current_user, @album)) }
@@ -102,5 +102,11 @@ class AlbumsController < BaseController
     redirect_to user_albums_path(current_user)
     flash[:notice] = :album_added_photos.l
   end
+
+  private
+
+  def album_params
+    params[:album].permit(:title, :description)
+  end
   
 end

data/app/controllers/base_controller.rb

@@ -60,9 +60,6 @@ class BaseController < ApplicationController
   def advertise
   end
 
-  def css_help
-  end
-
   protected
   def self.uses_tiny_mce(options = {}, &block)
     if block_given?
@@ -70,6 +67,7 @@ class BaseController < ApplicationController
     end
 
     new_configuration = TinyMCE::Rails.configuration.merge(options.delete(:options)).options
+    new_configuration.stringify_keys!
 
     # Set instance vars in the current class
     p = Proc.new do |c|
@@ -124,24 +122,23 @@ class BaseController < ApplicationController
       @recent_clippings = Clipping.find_recent(:limit => 10)
       @recent_photos = Photo.find_recent(:limit => 10)
       @recent_comments = Comment.find_recent(:limit => 13)
-      @popular_tags = popular_tags(30)
+      @popular_tags = popular_tags(30).to_a
       @recent_activity = User.recent_activity(:size => 15, :current => 1)
 
     end
 
     def get_additional_homepage_data
-      @sidebar_right = true
       @homepage_features = HomepageFeature.find_features
       @homepage_features_data = @homepage_features.collect {|f| [f.id, f.image.url(:large) ]  }
 
-      @active_users = User.find_by_activity({:limit => 5, :require_avatar => false})
+      @active_users = User.find_by_activity(:limit => 5, :require_avatar => false)
       @featured_writers = User.find_featured
 
       @featured_posts = Post.find_featured
 
-      @topics = Topic.find(:all, :limit => 5, :order => "replied_at DESC")
+      @topics = Topic.order("replied_at DESC").limit(5)
 
-      @popular_posts = Post.find_popular({:limit => 10})
+      @popular_posts = Post.find_popular(:limit => 10)
       @popular_polls = Poll.find_popular(:limit => 8)
     end
 

data/app/controllers/categories_controller.rb

@@ -3,41 +3,35 @@ class CategoriesController < BaseController
   before_filter :admin_required, :only => [:new, :edit, :update, :create, :destroy, :index]
 
   cache_sweeper :category_sweeper, :only => [:create, :update, :destroy]
-  
+
   # GET /categories
   # GET /categories.xml
   def index
-    @categories = Category.find(:all)
+    @categories = Category.all
 
     respond_to do |format|
       format.html # index.rhtml
       format.xml  { render :xml => @categories.to_xml }
     end
   end
-  
+
   # GET /categories/1
   # GET /categories/1.xml
   def show
     @category = Category.find(params[:id])
-    @sidebar_right = true
-      
+
     order = (params[:popular] ? "view_count #{params[:popular].eql?('DESC') ? 'DESC' : 'ASC'}": "published_at DESC")
 
     @posts = Post.includes(:tags).where('category_id = ?', @category.id).order(order).page(params[:page])
-    
-    @popular_posts = @category.posts.order("view_count DESC").find(:all, :limit => 10)
+
+    @popular_posts = @category.posts.order("view_count DESC").limit(10)
     @popular_polls = Poll.find_popular_in_category(@category)
 
     @rss_title = "#{configatron.community_name}: #{@category.name} "+:posts.l
     @rss_url = category_path(@category, :format => :rss)
 
-    @active_users = User.find(:all,
-      :include => :posts,
-      :limit => 5,
-      :conditions => ["posts.category_id = ? AND posts.published_at > ?", @category.id, 14.days.ago],
-      :order => "users.view_count DESC"
-      )
-    
+    @active_users = User.includes(:posts).where("posts.category_id = ? AND posts.published_at > ?", @category.id, 14.days.ago).references(:posts).limit(5).order("users.view_count DESC").to_a
+
     respond_to do |format|
       format.html # show.rhtml
       format.rss {
@@ -48,13 +42,13 @@ class CategoriesController < BaseController
                     :pub_date => :published_at} })
       }
     end
-  end 
-    
+  end
+
   # GET /categories/new
   def new
     @category = Category.new
   end
-  
+
   # GET /categories/1;edit
   def edit
     @category = Category.find(params[:id])
@@ -63,12 +57,12 @@ class CategoriesController < BaseController
   # POST /categories
   # POST /categories.xml
   def create
-    @category = Category.new(params[:category])
-    
+    @category = Category.new(category_params)
+
     respond_to do |format|
       if @category.save
         flash[:notice] = :category_was_successfully_created.l
-        
+
         format.html { redirect_to category_url(@category) }
         format.xml do
           headers["Location"] = category_url(@category)
@@ -80,41 +74,47 @@ class CategoriesController < BaseController
       end
     end
   end
-  
-  # PUT /categories/1
-  # PUT /categories/1.xml
+
+  # patch /categories/1
+  # patch /categories/1.xml
   def update
     @category = Category.find(params[:id])
-    
+
     respond_to do |format|
-      if @category.update_attributes(params[:category])
+      if @category.update_attributes(category_params)
         format.html { redirect_to category_url(@category) }
         format.xml  { render :nothing => true }
       else
         format.html { render :action => "edit" }
-        format.xml  { render :xml => @category.errors.to_xml }        
+        format.xml  { render :xml => @category.errors.to_xml }
       end
     end
   end
-  
+
   # DELETE /categories/1
   # DELETE /categories/1.xml
   def destroy
     @category = Category.find(params[:id])
     @category.destroy
-    
+
     respond_to do |format|
       format.html { redirect_to categories_url   }
       format.xml  { render :nothing => true }
     end
   end
-  
+
   def show_tips
     @category = Category.find(params[:id] )
     render :partial => "/categories/tips", :locals => {:category => @category}
   rescue ActiveRecord::RecordNotFound
     render :partial => "/categories/tips", :locals => {:category => nil}
   end
-  
-  
+
+
+  private
+
+  def category_params
+    params[:category].permit(:name, :tips, :new_post_text, :nav_text)
+  end
+
 end

data/app/controllers/clippings_controller.rb

@@ -4,15 +4,15 @@ class ClippingsController < BaseController
   before_filter :require_current_user, :only => [:new, :edit, :update, :destroy]
 
   uses_tiny_mce do
-    {:only => [:show,:new_clipping], :options => configatron.default_mce_options}    
+    {:only => [:show,:new_clipping], :options => configatron.default_mce_options}
   end
 
-  cache_sweeper :taggable_sweeper, :only => [:create, :update, :destroy]    
+  cache_sweeper :taggable_sweeper, :only => [:create, :update, :destroy]
 
   def site_index
     @clippings = Clipping.includes(:tags).order(params[:recent] ? "created_at DESC" : "clippings.favorited_count DESC")
-    
-    @clippings = @clippings.where('tags.name = ?', params[:tag_name]) if params[:tag_name]
+
+    @clippings = @clippings.where('tags.name = ?', params[:tag_name]).references(:tags) if params[:tag_name]
     @clippings = @clippings.where('created_at > ?', 4.weeks.ago) unless params[:recent]
 
     @clippings = @clippings.page(params[:page])
@@ -44,9 +44,9 @@ class ClippingsController < BaseController
     @clippings = @clippings.where('tags.name = ?', params[:tag_name]) if params[:tag_name]
 
     @clippings = @clippings.page(params[:page])
-    
-    @tags = Clipping.includes(:taggings).where(:user_id => @user.id).tag_counts(:limit => 20)    
-    
+
+    @tags = Clipping.includes(:taggings).where(:user_id => @user.id).tag_counts(:limit => 20)
+
     @clippings_data = @clippings.collect {|c| [c.id, c.image_url, c.description, c.url ]  }
 
     @rss_title = "#{configatron.community_name}: #{@user.login}'s clippings"
@@ -133,7 +133,7 @@ class ClippingsController < BaseController
   # POST /clippings.xml
   def create
     @user = current_user
-    @clipping = @user.clippings.new(params[:clipping])
+    @clipping = @user.clippings.new(clipping_params)
     @clipping.user = @user
     @clipping.tag_list = params[:tag_list] || ''
 
@@ -153,19 +153,19 @@ class ClippingsController < BaseController
     end
   end
 
-  # PUT /clippings/1
-  # PUT /clippings/1.xml
+  # patch /clippings/1
+  # patch /clippings/1.xml
   def update
     @user = User.find(params[:user_id])
     @clipping = Clipping.find(params[:id])
     @clipping.tag_list = params[:tag_list] || ''
 
-    if @clipping.update_attributes(params[:clipping])
+    if @clipping.update_attributes(clipping_params)
       respond_to do |format|
         format.html { redirect_to user_clipping_url(@user, @clipping) }
       end
     else
-      respond_to do |format|      
+      respond_to do |format|
         format.html { render :action => "edit" }
       end
     end
@@ -188,4 +188,10 @@ class ClippingsController < BaseController
   def description_for_rss(clip)
     "<a href='#{user_clipping_url(clip.user, clip)}' title='#{clip.title_for_rss}'><img src='#{clip.image_url}' alt='#{clip.description}' /></a>"
   end
+
+  private
+
+  def clipping_params
+    params.require(:clipping).permit(:url, :description, :image_url, :image)
+  end
 end

data/app/controllers/comments_controller.rb

@@ -22,7 +22,10 @@ class CommentsController < BaseController
 
   def update
     @comment = Comment.find(params[:id])
-    @comment.update_attributes(params[:comment])
+    @comment.update_attributes!(comment_params)
+  rescue ActiveRecord::RecordInvalid
+    flash[:error] = :an_error_occurred.l
+  ensure
     respond_to do |format|
       format.js
     end
@@ -30,7 +33,7 @@ class CommentsController < BaseController
 
   def approve
     @comment = Comment.find(params[:id])
-    @comment.ham! if !configatron.akismet_key.nil?
+    @comment.ham! if configatron.has_key?(:akismet_key)
     @comment.role = 'published'
     @comment.save!
     respond_to do |format|
@@ -100,7 +103,7 @@ class CommentsController < BaseController
     commentable_type = get_commentable_type(params[:commentable_type])
     @commentable = commentable_type.singularize.constantize.find(params[:commentable_id])
 
-    @comment = @commentable.comments.new(params[:comment])
+    @comment = @commentable.comments.new(comment_params)
 
     @comment.recipient = @commentable.owner
     @comment.user_id = current_user.id if current_user
@@ -122,7 +125,7 @@ class CommentsController < BaseController
   def destroy
     @comment = Comment.find(params[:id])
     if @comment.can_be_deleted_by(current_user) && @comment.destroy
-      if params[:spam] && !configatron.akismet_key.nil?
+      if params[:spam] && configatron.has_key?(:akismet_key)
         @comment.spam!
       end
       flash.now[:notice] = :the_comment_was_deleted.l
@@ -133,23 +136,25 @@ class CommentsController < BaseController
       format.html { redirect_to users_url }
       format.js   {
         render :inline => flash[:error], :status => 500 if flash[:error]
-        render :nothing => true if flash[:notice]
+        render if flash[:notice]
       }
     end
   end
 
   def delete_selected
-    if request.post?
+    if request.delete?
       if params[:delete]
         params[:delete].each { |id|
           comment = Comment.find(id)
-          comment.spam! if params[:spam] && !configatron.akismet_key.nil?
+          comment.spam! if params[:spam] && configatron.has_key?(:akismet_key)
           comment.destroy if comment.can_be_deleted_by(current_user)
         }
       end
       flash[:notice] = :comments_deleted.l
-      redirect_to admin_comments_path
+    else
+      flash[:error] = :comments_not_deleted.l
     end
+    redirect_to admin_comments_path
   end
 
 
@@ -182,4 +187,8 @@ class CommentsController < BaseController
         })
     end
 
+  def comment_params
+    params.require(:comment).permit(:author_name, :author_email, :notify_by_email, :author_url, :comment)
+  end
+
 end

data/app/controllers/events_controller.rb

@@ -3,12 +3,12 @@ class EventsController < BaseController
   require 'htmlentities'
   caches_page :ical
   cache_sweeper :event_sweeper, :only => [:create, :update, :destroy]
- 
+
 
   uses_tiny_mce do
     {:only => [:new, :edit, :create, :update, :clone ], :options => configatron.default_mce_options}
   end
-  
+
   uses_tiny_mce do
     {:only => [:show], :options => configatron.simple_mce_options}
   end
@@ -19,7 +19,7 @@ class EventsController < BaseController
     @calendar = RiCal.Calendar
     @calendar.add_x_property 'X-WR-CALNAME', configatron.community_name
     @calendar.add_x_property 'X-WR-CALDESC', "#{configatron.community_name} #{:events.l}"
-    Event.find(:all).each do |ce_event|
+    Event.all.each do |ce_event|
       rical_event = RiCal.Event do |event|
         event.dtstart = ce_event.start_time
         event.dtend = ce_event.end_time
@@ -37,7 +37,7 @@ class EventsController < BaseController
   def show
     @is_admin_user = (current_user && current_user.admin?)
     @event = Event.find(params[:id])
-    @comments = @event.comments.find(:all, :limit => 20, :order => 'created_at DESC', :include => :user)
+    @comments = @event.comments.includes(:user).order('created_at DESC').limit(20)
   end
 
   def index
@@ -52,19 +52,19 @@ class EventsController < BaseController
   end
 
   def new
-    @event = Event.new(params[:event])
+    @event = Event.new
     @metro_areas, @states = setup_metro_area_choices_for(current_user)
     @metro_area_id, @state_id, @country_id = setup_location_for(current_user)
   end
-  
+
   def edit
     @event = Event.find(params[:id])
     @metro_areas, @states = setup_metro_area_choices_for(@event)
     @metro_area_id, @state_id, @country_id = setup_location_for(@event)
   end
-    
+
   def create
-    @event = Event.new(params[:event])
+    @event = Event.new(event_params)
     @event.user = current_user
     if params[:metro_area_id]
       @event.metro_area = MetroArea.find(params[:metro_area_id])
@@ -74,10 +74,10 @@ class EventsController < BaseController
     respond_to do |format|
       if @event.save
         flash[:notice] = :event_was_successfully_created.l
-        
+
         format.html { redirect_to event_path(@event) }
       else
-        format.html { 
+        format.html {
           @metro_areas, @states = setup_metro_area_choices_for(@event)
           if params[:metro_area_id]
             @metro_area_id = params[:metro_area_id].to_i
@@ -87,7 +87,7 @@ class EventsController < BaseController
           render :action => "new"
         }
       end
-    end    
+    end
   end
 
   def update
@@ -97,12 +97,12 @@ class EventsController < BaseController
     else
       @event.metro_area = nil
     end
-        
+
     respond_to do |format|
-      if @event.update_attributes(params[:event])
+      if @event.update_attributes(event_params)
         format.html { redirect_to event_path(@event) }
       else
-        format.html { 
+        format.html {
           @metro_areas, @states = setup_metro_area_choices_for(@event)
           if params[:metro_area_id]
             @metro_area_id = params[:metro_area_id].to_i
@@ -114,11 +114,11 @@ class EventsController < BaseController
       end
     end
   end
-  
+
   def destroy
     @event = Event.find(params[:id])
     @event.destroy
-    
+
     respond_to do |format|
       format.html { redirect_to :back }
     end
@@ -139,16 +139,16 @@ class EventsController < BaseController
       if object.is_a? Event
         states = object.metro_area.country.states
         if object.metro_area.state
-          metro_areas = object.metro_area.state.metro_areas.all(:order=>"name")
+          metro_areas = object.metro_area.state.metro_areas.order("name")
         else
-          metro_areas = object.metro_area.country.metro_areas.all(:order=>"name")
-        end        
+          metro_areas = object.metro_area.country.metro_areas.order("name")
+        end
       elsif object.is_a? User
         states = object.country.states if object.country
         if object.state
-          metro_areas = object.state.metro_areas.all(:order => "name")
+          metro_areas = object.state.metro_areas..order("name")
         else
-          metro_areas = object.country.metro_areas.all(:order => "name")
+          metro_areas = object.country.metro_areas.order("name")
         end
       end
     end
@@ -170,4 +170,8 @@ class EventsController < BaseController
     return metro_area_id, state_id, country_id
   end
 
+  def event_params
+    params[:event].permit(:name, :start_time, :end_time, :description, :metro_area, :location, :allow_rsvp)
+  end
+
 end