github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Enabled strong_parameters across all models/controllers.

Browse Source 
All models are now using ActiveModel::ForbiddenAttributesProtection, which shifts the responsibility for parameter whitelisting for mass-assignments from the model to the controller. attr_accessible has been disabled and removed as this functionality replaces that.

The require_parameters method in the ApplicationController has been removed in favor of strong_parameters' #require method.

It is important to note that there is still some refactoring required to get all parameters to pass through #require and #permit so that we can guarantee that parameter values are scalar. Currently strong_parameters, in most cases, is only being utilized to require parameters and to whitelist the few places that do mass-assignments.
This commit is contained in:
Ian Christian Myers
2013-06-06 00:14:32 -07:00
parent a3d62fdf69
commit 0d01c33482
34 changed files with 67 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/controllers/clicks_controller.rb
View File

@ -3,14 +3,11 @@ class ClicksController < ApplicationController
skip_before_filter :check_xhr
def track
requires_parameter(:url)
if params[:topic_id].present? || params[:post_id].present?
args = {url: params[:url], ip: request.remote_ip}
args[:user_id] = current_user.id if current_user.present?
args[:post_id] = params[:post_id].to_i if params[:post_id].present?
args[:topic_id] = params[:topic_id].to_i if params[:topic_id].present?
params = track_params.merge(ip: request.remote_ip)
TopicLinkClick.create_from(args)
if params[:topic_id].present? || params[:post_id].present?
params.merge!({ user_id: current_user.id }) if current_user.present?
TopicLinkClick.create_from(params)
end
# Sometimes we want to record a link without a 302. Since XHR has to load the redirected
@ -22,4 +19,11 @@ class ClicksController < ApplicationController
end
end
private
def track_params
params.require(:url)
params.permit(:url, :post_id, :topic_id, :redirect)
end
end