community_engine 2.3.2 → 3.0.0

data/app/controllers/favorites_controller.rb

@@ -2,35 +2,35 @@ class FavoritesController < BaseController
   before_filter :login_required, :only => [:destroy]
   before_filter :find_user, :only => [:show, :index]
 
-  cache_sweeper :favorite_sweeper, :only => [:create, :destroy]  
-  
+  cache_sweeper :favorite_sweeper, :only => [:create, :destroy]
+
   def create
     @favoritable = params[:favoritable_type].classify.constantize.find(params[:favoritable_id])
     @favorite = Favorite.new(:ip_address => request.remote_ip, :favoritable => @favoritable )
     @favorite.user = current_user || nil
     @favorite.save
-    
+
     respond_to do |format|
       format.js
     end
   end
-  
+
   def destroy
     @favorite = current_user.favorites.find(params[:id])
     @favorite.destroy
-    
+
     respond_to do |format|
       format.js
-    end    
+    end
   end
-  
+
   def show
     @favorite = @user.favorites.find(params[:id])
   end
-  
-  def index  
+
+  def index
     @favorites = Favorite.recent.by_user(@user).page(params[:page])
   end
-  
-  
-end
+
+
+end

data/app/controllers/forums_controller.rb

@@ -1,13 +1,12 @@
 class ForumsController < BaseController
-  before_filter :admin_required, :except => [:index, :show]
-  before_filter :find_or_initialize_forum
+  before_action :admin_required, :except => [:index, :show]
 
   uses_tiny_mce do    
     {:options => configatron.default_mce_options}
   end
   
   def index
-    @forums = Forum.find(:all, :order => "position")
+    @forums = Forum.order("position")
     respond_to do |format|
       format.html
       format.xml { render :xml => @forums }
@@ -15,6 +14,7 @@ class ForumsController < BaseController
   end
 
   def show
+    @forum = Forum.find(params[:id])
     respond_to do |format|
       format.html do
         # keep track of when we last viewed this forum for activity indicators
@@ -28,8 +28,13 @@ class ForumsController < BaseController
       end
     end
   end
+
+  def new
+    @forum = Forum.new
+  end
   
   def create
+    @forum = Forum.new(forum_params)
     @forum.tag_list = params[:tag_list] || ''
     @forum.save!
     respond_to do |format|
@@ -38,9 +43,14 @@ class ForumsController < BaseController
     end
   end
 
+  def edit
+    @forum = Forum.find(params[:id])
+  end
+
   def update
+    @forum = Forum.find(params[:id])
     @forum.tag_list = params[:tag_list] || ''
-    @forum.update_attributes!(params[:forum])
+    @forum.update_attributes!(forum_params)
     respond_to do |format|
       format.html { redirect_to forums_path }
       format.xml  { head 200 }
@@ -48,6 +58,7 @@ class ForumsController < BaseController
   end
   
   def destroy
+    @forum = Forum.find(params[:id])
     @forum.destroy
     respond_to do |format|
       format.html { redirect_to forums_path }
@@ -55,10 +66,10 @@ class ForumsController < BaseController
     end
   end
   
-  protected
-    def find_or_initialize_forum
-      @forum = params[:id] ? Forum.find(params[:id]) : Forum.new(params[:forum])
-    end
-    
+  private
+
+  def forum_params
+    params[:forum].permit(:name, :position, :description)
+  end
     
 end

data/app/controllers/friendships_controller.rb

@@ -1,25 +1,12 @@
 class FriendshipsController < BaseController
-  before_filter :login_required, :except => [:accepted, :index]
-  before_filter :find_user, :only => [:accepted, :pending, :denied]
-  before_filter :require_current_user, :only => [:accept, :deny, :pending, :destroy]
-
-  def index
-    @body_class = 'friendships-browser'
-    
-    @user = (params[:id] ||params[:user_id]) ? User.find((params[:id] || params[:user_id] )): Friendship.find(:first).user
-    @friendships = Friendship.find(:all, :conditions => ['user_id = ? OR friend_id = ?', @user.id, @user.id], :limit => 40)
-    @users = User.find(:all, :conditions => ['users.id in (?)', @friendships.collect{|f| f.friend_id }])    
-    
-    respond_to do |format|
-      format.html 
-      format.xml { render :action => 'index.rxml', :layout => false}    
-    end
-  end
-  
+  before_action :login_required, :except => [:accepted]
+  before_action :find_user, :only => [:accepted, :pending, :denied]
+  before_action :require_current_user, :only => [:accept, :deny, :pending, :destroy]
+
   def deny
-    @user = User.find(params[:user_id])    
+    @user = User.find(params[:user_id])
     @friendship = @user.friendships.find(params[:id])
- 
+
     respond_to do |format|
       if @friendship.update_attributes(:friendship_status => FriendshipStatus[:denied]) && @friendship.reverse.update_attributes(:friendship_status => FriendshipStatus[:denied])
         flash[:notice] = :the_friendship_was_denied.l
@@ -27,18 +14,18 @@ class FriendshipsController < BaseController
       else
         format.html { render :action => "edit" }
       end
-    end    
+    end
   end
 
   def accept
-    @user = User.find(params[:user_id])    
+    @user = User.find(params[:user_id])
     @friendship = @user.friendships_not_initiated_by_me.find(params[:id])
- 
+
     respond_to do |format|
       if @friendship.update_attributes(:friendship_status => FriendshipStatus[:accepted]) && @friendship.reverse.update_attributes(:friendship_status => FriendshipStatus[:accepted])
         flash[:notice] = :the_friendship_was_accepted.l
-        format.html { 
-          redirect_to accepted_user_friendships_path(@user) 
+        format.html {
+          redirect_to accepted_user_friendships_path(@user)
         }
       else
         format.html { render :action => "edit" }
@@ -47,9 +34,9 @@ class FriendshipsController < BaseController
   end
 
   def denied
-    @user = User.find(params[:user_id])    
+    @user = User.find(params[:user_id])
     @friendships = @user.friendships.where("friendship_status_id = ?", FriendshipStatus[:denied].id).page(params[:page])
-    
+
     respond_to do |format|
       format.html
     end
@@ -57,64 +44,64 @@ class FriendshipsController < BaseController
 
 
   def accepted
-    @user = User.find(params[:user_id])    
+    @user = User.find(params[:user_id])
     @friend_count = @user.accepted_friendships.count
     @pending_friendships_count = @user.pending_friendships.count
-          
+
     @friendships = @user.friendships.accepted.page(params[:page]).per(12)
-    
+
     respond_to do |format|
       format.html
     end
   end
-  
+
   def pending
-    @user = User.find(params[:user_id])    
-    @friendships = @user.friendships.find(:all, :conditions => ["initiator = ? AND friendship_status_id = ?", false, FriendshipStatus[:pending].id])
-    
+    @user = User.find(params[:user_id])
+    @friendships = @user.friendships.where("initiator = ? AND friendship_status_id = ?", false, FriendshipStatus[:pending].id)
+
     respond_to do |format|
       format.html
     end
   end
-  
+
   def show
     @friendship = Friendship.find(params[:id])
     @user = @friendship.user
-    
+
     respond_to do |format|
       format.html
     end
   end
-  
+
 
   def create
     @user = User.find(params[:user_id])
     @friendship = Friendship.new(:user_id => params[:user_id], :friend_id => params[:friend_id], :initiator => true )
-    @friendship.friendship_status_id = FriendshipStatus[:pending].id    
-    reverse_friendship = Friendship.new(params[:friendship])
-    reverse_friendship.friendship_status_id = FriendshipStatus[:pending].id 
+    @friendship.friendship_status_id = FriendshipStatus[:pending].id
+    reverse_friendship = Friendship.new
+    reverse_friendship.friendship_status_id = FriendshipStatus[:pending].id
     reverse_friendship.user_id, reverse_friendship.friend_id = @friendship.friend_id, @friendship.user_id
-    
+
     respond_to do |format|
       if @friendship.save && reverse_friendship.save
         UserNotifier.friendship_request(@friendship).deliver if @friendship.friend.notify_friend_requests?
         format.html {
-          flash[:notice] = :friendship_requested.l_with_args(:friend => @friendship.friend.login) 
+          flash[:notice] = :friendship_requested.l_with_args(:friend => @friendship.friend.login)
           redirect_to accepted_user_friendships_path(@user)
         }
-        format.js { render( :inline => :requested_friendship_with.l+" #{@friendship.friend.login}." ) }        
+        format.js {@text = "#{:requested_friendship_with.l} #{@friendship.friend.login}."}
       else
         flash.now[:error] = :friendship_could_not_be_created.l
         format.html { redirect_to user_friendships_path(@user) }
-        format.js { render( :inline => "Friendship request failed." ) }                
+        format.js {@text = "#{:friendship_request_failed.l}."}
       end
     end
   end
-    
+
   def destroy
-    @user = User.find(params[:user_id])    
+    @user = User.find(params[:user_id])
     @friendship = Friendship.find(params[:id])
-    Friendship.transaction do 
+    Friendship.transaction do
       @friendship.destroy
       @friendship.reverse.destroy
     end
@@ -122,5 +109,11 @@ class FriendshipsController < BaseController
       format.html { redirect_to accepted_user_friendships_path(@user) }
     end
   end
-  
-end
+
+  private
+
+  def friendship_params
+    params[:friendship].permit(:frienship_status, :initiator, :user, :user_id)
+  end
+
+end

data/app/controllers/homepage_features_controller.rb

@@ -7,9 +7,9 @@ class HomepageFeaturesController < BaseController
   before_filter :admin_required
 
   def index
-    @search = HomepageFeature.search(params[:search])
-    @search.meta_sort ||= 'created_at.desc'    
-    @homepage_features = @search.page(params[:page]).per(100)
+    @search = HomepageFeature.search(params[:q])
+    @homepage_features = @search.result
+    @homepage_features = @homepage_features.order('created_at DESC').page(params[:page]).per(100)
     respond_to do |format|
       format.html
     end
@@ -32,7 +32,7 @@ class HomepageFeaturesController < BaseController
   end
 
   def create
-    @homepage_feature = HomepageFeature.new(params[:homepage_feature])
+    @homepage_feature = HomepageFeature.new(homepage_feature_params)
     
     respond_to do |format|
       if @homepage_feature.save
@@ -49,7 +49,7 @@ class HomepageFeaturesController < BaseController
     @homepage_feature = HomepageFeature.find(params[:id])
     
     respond_to do |format|
-      if @homepage_feature.update_attributes(params[:homepage_feature])
+      if @homepage_feature.update_attributes(homepage_feature_params)
         format.html { redirect_to homepage_feature_url(@homepage_feature) }
       else
         format.html { render :action => "edit" }
@@ -65,4 +65,10 @@ class HomepageFeaturesController < BaseController
       format.html { redirect_to homepage_features_url   }
     end
   end
+
+  private
+
+  def homepage_feature_params
+    params[:homepage_feature].permit(:url, :title, :description, :image)
+  end
 end

data/app/controllers/invitations_controller.rb

@@ -6,15 +6,15 @@ class InvitationsController < BaseController
     @invitations = @user.invitations
 
     respond_to do |format|
-      format.html 
+      format.html
     end
   end
-  
+
   def new
     @user = current_user
     @invitation = Invitation.new
   end
-  
+
 
   def edit
     @invitation = Invitation.find(params[:id])
@@ -24,17 +24,17 @@ class InvitationsController < BaseController
   def create
     @user = current_user
 
-    @invitation = Invitation.new(params[:invitation])
+    @invitation = Invitation.new(invitation_params)
     @invitation.user = @user
-    
+
     respond_to do |format|
       if @invitation.save
         flash[:notice] = :invitation_was_successfully_created.l
-        format.html { 
+        format.html {
           unless params[:welcome]
-            redirect_to user_path(@invitation.user) 
+            redirect_to user_path(@invitation.user)
           else
-            redirect_to welcome_complete_user_path(@invitation.user)            
+            redirect_to welcome_complete_user_path(@invitation.user)
           end
         }
       else
@@ -42,5 +42,11 @@ class InvitationsController < BaseController
       end
     end
   end
-  
+
+  private
+
+  def invitation_params
+    params.require(:invitation).permit(:email_addresses, :message)
+  end
+
 end

data/app/controllers/messages_controller.rb

@@ -1,5 +1,5 @@
 class MessagesController < BaseController
-  before_filter :find_user, :except => [:auto_complete_for_username]
+  before_filter :find_user
   before_filter :login_required
   before_filter :require_ownership_or_moderator, :except => [:auto_complete_for_username]
 
@@ -8,12 +8,14 @@ class MessagesController < BaseController
   uses_tiny_mce do
     {:options => configatron.default_mce_options}
   end
-  
+
   def auto_complete_for_username
-    @users = User.find(:all, :conditions => [ 'LOWER(login) LIKE ?', '%' + (params[:message][:to]) + '%' ])
-    render :inline => "<%= auto_complete_result(@users, 'login') %>"
+    @usernames = User.active.where.not(login: @user.login).pluck(:login)
+    respond_to do |format|
+      format.json {render :inline => @usernames.to_json}
+    end
   end
-    
+
   def index
     if params[:mailbox] == "sent"
       @messages = @user.sent_messages.page(params[:page]).per(20)
@@ -21,35 +23,35 @@ class MessagesController < BaseController
       @messages = @user.message_threads_as_recipient.order('updated_at DESC').page(params[:page]).per(20)
     end
   end
-  
+
   def show
     @message = Message.read(params[:id], @user)
     @message_thread = MessageThread.for(@message, (admin? ? @message.recipient : current_user ))
-    @reply = Message.new_reply(@user, @message_thread, params)    
+    @reply = Message.new_reply(@user, @message_thread, params)
   end
-  
+
   def new
     if params[:reply_to]
       in_reply_to = Message.find_by_id(params[:reply_to])
       message_thread = MessageThread.for(in_reply_to, current_user)
     end
-    @message = Message.new_reply(@user, message_thread, params)    
+    @message = Message.new_reply(@user, message_thread, params)
   end
-  
+
   def create
     messages = []
 
-    if params[:message][:to].blank?
+    if params.require(:message)[:to].blank?
       # If 'to' field is empty, call validations to catch other errors
-      @message = Message.new(params[:message])        
+      @message = Message.new(message_params)
       @message.valid?
       render :action => :new and return
     else
-      @message = Message.new(params[:message])
-      @message.recipient= User.where('lower(login) = ?', params[:message][:to].strip.downcase).first
+      @message = Message.new(message_params)
+      @message.recipient= User.where('lower(login) = ?', params.require(:message)[:to].strip.downcase).first
       @message.sender = @user
       unless @message.valid?
-        render :action => :new and return        
+        render :action => :new and return
       else
         @message.save!
       end
@@ -62,7 +64,7 @@ class MessagesController < BaseController
     if request.post?
       if params[:delete]
         params[:delete].each { |id|
-          @message = Message.find(:first, :conditions => ["messages.id = ? AND (sender_id = ? OR recipient_id = ?)", id, @user, @user])
+          @message = Message.where("messages.id = ? AND (sender_id = ? OR recipient_id = ?)", id, @user, @user).first
           @message.mark_deleted(@user) unless @message.nil?
         }
         flash[:notice] = :messages_deleted.l
@@ -70,7 +72,7 @@ class MessagesController < BaseController
       redirect_to user_messages_path(@user)
     end
   end
-  
+
   def delete_message_threads
     if request.post?
       if params[:delete]
@@ -84,7 +86,7 @@ class MessagesController < BaseController
     end
 
   end
-  
+
   private
     def find_user
       @user = User.find(params[:user_id])
@@ -95,5 +97,9 @@ class MessagesController < BaseController
         redirect_to :controller => 'sessions', :action => 'new' and return false
       end
       return @user
-    end    
+    end
+
+  def message_params
+    params.require(:message).permit(:to, :subject, :body,  :recipient_id, :sender_id, :parent_id)
+  end
 end