trusty-cms 3.0.4 → 3.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f1e344dee29ecc560615b8fa2f8bbf2022f213f7
-  data.tar.gz: 3fc32b15c44fd8f643c85eb086dd9b0e78d5b3b5
+  metadata.gz: f20f67036374cef3064eb22bacb17d08739cf2a7
+  data.tar.gz: d4658bcafeb27b4068d654c90de3ef57afb84816
 SHA512:
-  metadata.gz: b8bea05fe7e7ec1c2617fd9f80e07a6e81ff935509570ab1663bfc6bf81c74f9df56fbd43eba7028c7c0cb104a2a1cec65a7474f7a376f3e295c8a1e101c6f0f
-  data.tar.gz: f3c8bfdffb0fd06c92e0136de84a1876e2f95054867fb735a5a4bd40c29a3ffe930dc440140c24651db01aa30f3256f2fe605e327cc20746ff07d0ecf4ad90c4
+  metadata.gz: 6e169ac5cd20306ecf77b3d7164fec690a7706c4367765035abf458f0734bc600e7eed09155041a5219e251a55752a66300f15937b6356db51506495a5c4cd1f
+  data.tar.gz: 8cc42d0af8bdd0c120e117cb55df2fdc7095758e51f8724795d2da6562c739ca955018ed2f7cd7a939e84f7782434c484685594d1394cd86e6a78a8b81e33976

data/Gemfile

@@ -20,7 +20,6 @@ group :development, :test do
   gem 'poltergeist',      '~> 1.14.0'
   gem 'factory_girl_rails', '~> 4.6.0'
   gem 'rails-observers', :git => 'https://github.com/rails/rails-observers'
-  gem 'protected_attributes_continued'
   gem 'pry-rails'
   gem 'mysql2',          '~> 0.4.2'
   gem 'pry-byebug'

data/Gemfile.lock

@@ -8,7 +8,7 @@ GIT
 PATH
   remote: .
   specs:
-    trusty-cms (3.0.4)
+    trusty-cms (3.0.6)
       RedCloth (~> 4.3.2)
       acts_as_tree (~> 2.6.1)
       bundler (~> 1.7)
@@ -155,7 +155,7 @@ GEM
     json (2.1.0)
     launchy (2.4.3)
       addressable (~> 2.3)
-    libv8 (3.16.14.19)
+    libv8 (3.16.14.19-x86_64-darwin-16)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
     mail (2.6.6)
@@ -176,8 +176,6 @@ GEM
       capybara (~> 2.1)
       cliver (~> 0.3.1)
       websocket-driver (>= 0.2.0)
-    protected_attributes_continued (1.3.0)
-      activemodel (~> 5.0)
     pry (0.10.4)
       coderay (~> 1.1.0)
       method_source (~> 0.8.1)
@@ -296,7 +294,6 @@ DEPENDENCIES
   mysql2 (~> 0.4.2)
   nokogiri (>= 1.7.1)
   poltergeist (~> 1.14.0)
-  protected_attributes_continued
   pry (~> 0.10.0)
   pry-byebug
   pry-rails

data/app/controllers/admin/page_fields_controller.rb

@@ -1,9 +1,16 @@
 class Admin::PageFieldsController < Admin::ResourceController
   def create
-    self.model = PageField.new(params[model_symbol])
+    self.model = PageField.new(page_fields_params)
     @controller_name = 'page'
     @template_name = 'edit'
     render :partial => "page_field", :object => model,
       :locals => { :page_field_counter => params[:page_field_counter].to_i}
   end
+
+  private
+
+  def page_fields_params
+    params.permit(:name, :content)
+  end
+
 end

data/app/controllers/admin/page_parts_controller.rb

@@ -1,9 +1,16 @@
 class Admin::PagePartsController < Admin::ResourceController
   def create
-    self.model.attributes = params[model_symbol]
+    self.model.attributes = page_parts_params
     @controller_name = 'page'
     @template_name = 'edit'
     render :partial => "page_part", :object => model,
       :locals => {:page_part_counter => params[:index].to_i}
   end
+
+private
+
+  def page_parts_params
+    params.permit(:name, :filter_id, :content)
+  end
+
 end

data/app/controllers/admin/preferences_controller.rb

@@ -11,7 +11,7 @@ class Admin::PreferencesController < ApplicationController
   end
 
   def update
-    if @user.update_attributes(params[:user])
+    if @user.update_attributes(preferences_params)
       redirect_to admin_configuration_path
     else
       flash[:error] = t('preferences_controller.error_updating')
@@ -26,4 +26,8 @@ class Admin::PreferencesController < ApplicationController
     @controller_name = 'user'
     @template_name   = 'preferences'
   end
+
+  def preferences_params
+    params.require(:user).permit(:name, :email, :login, :password, :password_confirmation, :locale)
+  end
 end

data/app/controllers/admin/resource_controller.rb

@@ -58,7 +58,7 @@ class Admin::ResourceController < ApplicationController
   [:create, :update].each do |action|
     class_eval %{
       def #{action}                                       # def create
-        model.update_attributes!(params[model_symbol])    #   model.update_attributes!(params[model_symbol])
+        model.update_attributes!(permitted_params[model_symbol])    #   model.update_attributes!(params[model_symbol])
         response_for :#{action}                           #   response_for :create
       end                                                 # end
     }, __FILE__, __LINE__
@@ -240,5 +240,14 @@ class Admin::ResourceController < ApplicationController
       params[:format] ||= 'html' unless request.xhr?
     end
 
+    def permitted_params
+      model_symbols = ActiveRecord::Base.descendants.map{|a| a.name.underscore.to_sym}
+      keys = params.keys.map{|k| k.underscore.to_sym}
+      valid_symbols = model_symbols & keys
+      valid_symbols.each do |symbol|
+        params[symbol].permit!
+      end
+      params
+    end
 
 end

data/app/models/layout.rb

@@ -1,5 +1,4 @@
 class Layout < ActiveRecord::Base
-  attr_protected :created_at, :updated_at
 
   # Default Order
   default_scope {order("name")}

data/app/models/page.rb

@@ -1,5 +1,4 @@
 class Page < ActiveRecord::Base
-  attr_protected :created_at, :updated_at
 
   class MissingRootPageError < StandardError
     def initialize(message = 'Database missing root page'); super end
@@ -9,7 +8,7 @@ class Page < ActiveRecord::Base
   before_save :update_virtual, :update_status, :set_allowed_children_cache
 
   # Associations
-  acts_as_tree :order => 'virtual DESC, title ASC'
+  acts_as_tree :order => 'title ASC'
   has_many :parts, {:class_name => 'PagePart', :dependent => :destroy}, -> {order(:id)}
   accepts_nested_attributes_for :parts, :allow_destroy => true
   has_many :fields, {:class_name => 'PageField', :dependent => :destroy}, -> {order(:id)}
@@ -51,7 +50,9 @@ class Page < ActiveRecord::Base
       layout_without_inheritance
     end
   end
-  alias_method_chain :layout, :inheritance
+
+  alias_method :layout_without_inheritance, :layout
+  alias_method :layout, :layout_with_inheritance
 
   def description
     self["description"]

data/app/models/page_field.rb

@@ -1,4 +1,3 @@
 class PageField < ActiveRecord::Base
-  attr_accessible :name, :content
   validates_presence_of :name
 end

data/app/models/page_part.rb

@@ -1,5 +1,4 @@
 class PagePart < ActiveRecord::Base
-  attr_accessible :name, :filter_id, :content
 
   # Default Order
   default_scope {order("name")}

data/app/models/trusty_cms/config.rb

@@ -71,7 +71,6 @@ module TrustyCms
     self.table_name = "config"
     after_save :update_cache
     attr_reader :definition
-    attr_accessible :key
 
     class ConfigError < RuntimeError; end
 

data/app/models/user.rb

@@ -2,7 +2,6 @@ require 'digest/sha1'
 
 class User < ActiveRecord::Base
   has_many :pages, :foreign_key => :created_by_id
-  attr_protected 'why_is_this_needed'
 
   # Default Order
   default_scope {order("name")}