maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use constants for Permitted params in controller (#14895)

Browse source 
* Use constants for controller permitted params

* User constants for controller set 2

Co-authored-by: Ben Halpern <bendhalpern@gmail.com>
This commit is contained in:
praveen raghav ns 2021-10-05 18:30:14 +05:30 • committed by GitHub
parent 68524069d0
commit 4b8576aec3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 75 additions and 66 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
app/controllers/admin/articles_controller.rb
View file

@ -6,6 +6,19 @@ module Admin
Audit::Logger.log(:moderator, current_user, params.dup)
end
ARTICLES_ALLOWED_PARAMS = %i[featured
social_image
body_markdown
approved
email_digest_eligible
boosted_additional_articles
boosted_dev_digest_email
main_image_background_hex_color
featured_number
user_id
co_author_ids_list
published_at].freeze
def index
@pinned_article = PinnedArticle.get
@ -103,19 +116,7 @@ module Admin
end
def article_params
allowed_params = %i[featured
social_image
body_markdown
approved
email_digest_eligible
boosted_additional_articles
boosted_dev_digest_email
main_image_background_hex_color
featured_number
user_id
co_author_ids_list
published_at]
params.require(:article).permit(allowed_params)
params.require(:article).permit(ARTICLES_ALLOWED_PARAMS)
end
def authorize_admin

5
app/controllers/admin/chat_channels_controller.rb
View file

@ -2,6 +2,8 @@ module Admin
class ChatChannelsController < Admin::ApplicationController
layout "admin"
CHAT_ALLOWED_PARAMS = %i[usernames_string channel_name username_string].freeze
def index
@q = ChatChannel.where(channel_type: "invite_only").includes(:users).ransack(params[:q])
@group_chat_channels = @q.result.page(params[:page]).per(50)
@ -51,8 +53,7 @@ module Admin
end
def chat_channel_params
allowed_params = %i[usernames_string channel_name username_string]
params.require(:chat_channel).permit(allowed_params)
params.require(:chat_channel).permit(CHAT_ALLOWED_PARAMS)
end
end
end

13
app/controllers/admin/events_controller.rb
View file

@ -3,6 +3,12 @@ module Admin
layout "admin"
include ApplicationHelper
EVENTS_ALLOWED_PARAMS = %i[
title category event_date starts_at ends_at
location_name cover_image location_url description_markdown published
host_name profile_image live_now
].freeze
def index
@events = Event.order(starts_at: :desc).page(params[:page]).per(20)
end
@ -44,12 +50,7 @@ module Admin
private
def event_params
allowed_params = %i[
title category event_date starts_at ends_at
location_name cover_image location_url description_markdown published
host_name profile_image live_now
]
params.require(:event).permit(allowed_params)
params.require(:event).permit(EVENTS_ALLOWED_PARAMS)
end
end
end

4
app/controllers/feedback_messages_controller.rb
View file

@ -3,6 +3,7 @@ class FeedbackMessagesController < ApplicationController
skip_before_action :verify_authenticity_token
FLASH_MESSAGE = "Make sure the forms are filled. 🤖 Other possible errors: "\
"%<errors>s".freeze
FEEDBACK_ALLOWED_PARAMS = %i[message feedback_type category reported_url offender_id].freeze
def create
flash.clear
@ -61,8 +62,7 @@ class FeedbackMessagesController < ApplicationController
end
def feedback_message_params
allowed_params = %i[message feedback_type category reported_url offender_id]
params.require(:feedback_message).permit(allowed_params)
params.require(:feedback_message).permit(FEEDBACK_ALLOWED_PARAMS)
end
def rate_limit?

50
app/controllers/organizations_controller.rb
View file

@ -1,6 +1,31 @@
class OrganizationsController < ApplicationController
after_action :verify_authorized
ORGANIZATIONS_PERMITTED_PARAMS = %i[
id
name
summary
tag_line
slug
url
proof
profile_image
nav_image
dark_nav_image
location
company_size
tech_stack
email
story
bg_color_hex
text_color_hex
twitter_username
github_username
cta_button_text
cta_button_url
cta_body_markdown
].freeze
def create
rate_limit!(:organization_creation)
@ -74,30 +99,7 @@ class OrganizationsController < ApplicationController
private
def permitted_params
%i[
id
name
summary
tag_line
slug
url
proof
profile_image
nav_image
dark_nav_image
location
company_size
tech_stack
email
story
bg_color_hex
text_color_hex
twitter_username
github_username
cta_button_text
cta_button_url
cta_body_markdown
]
ORGANIZATIONS_PERMITTED_PARAMS
end
def organization_params

10
app/controllers/podcasts_controller.rb
View file

@ -6,6 +6,10 @@ class PodcastsController < ApplicationController
around_action :skip_bullet, only: %i[create], if: -> { defined?(Bullet) }
IMAGE_KEYS = %w[image pattern_image].freeze
PODCASTS_ALLOWED_PARAMS = %i[
android_url image itunes_url main_color_hex overcast_url pattern_image
slug soundcloud_url twitter_username website_url title feed_url description
].freeze
def new
@podcast = Podcast.new
@ -42,11 +46,7 @@ class PodcastsController < ApplicationController
end
def podcast_params
allowed_params = %i[
android_url image itunes_url main_color_hex overcast_url pattern_image
slug soundcloud_url twitter_username website_url title feed_url description
]
params.require(:podcast).permit(allowed_params)
params.require(:podcast).permit(PODCASTS_ALLOWED_PARAMS)
end
def skip_bullet

5
app/controllers/poll_skips_controller.rb
View file

@ -1,6 +1,8 @@
class PollSkipsController < ApplicationController
before_action :authenticate_user!, only: %i[create]
POLL_SKIPS_PERMITTED_PARAMS = %i[poll_id].freeze
def create
poll = Poll.find(poll_skips_params[:poll_id])
poll.poll_skips.create_or_find_by(user_id: current_user.id)
@ -16,7 +18,6 @@ class PollSkipsController < ApplicationController
private
def poll_skips_params
accessible = %i[poll_id]
params.require(:poll_skip).permit(accessible)
params.require(:poll_skip).permit(POLL_SKIPS_PERMITTED_PARAMS)
end
end

5
app/controllers/poll_votes_controller.rb
View file

@ -1,6 +1,8 @@
class PollVotesController < ApplicationController
before_action :authenticate_user!, only: %i[create]
POLL_VOTES_PERMITTED_PARMS = %i[poll_option_id].freeze
def show
@poll = Poll.find(params[:id]) # Querying the poll instead of the poll vote
@poll_vote = @poll.poll_votes.where(user_id: current_user).first
@ -25,7 +27,6 @@ class PollVotesController < ApplicationController
private
def poll_vote_params
accessible = %i[poll_option_id]
params.require(:poll_vote).permit(accessible)
params.require(:poll_vote).permit(POLL_VOTES_PERMITTED_PARMS)
end
end

4
app/controllers/stripe_active_cards_controller.rb
View file

@ -5,6 +5,8 @@ class StripeActiveCardsController < ApplicationController
AUDIT_LOG_CATEGORY = "user.credit_card.edit".freeze
private_constant :AUDIT_LOG_CATEGORY
STRIPE_PERMITTED_PARAMS = %i[stripe_token].freeze
def create
authorize :stripe_active_card
@ -87,7 +89,7 @@ class StripeActiveCardsController < ApplicationController
end
def stripe_params
params.permit(%i[stripe_token])
params.permit(STRIPE_PERMITTED_PARAMS)
end
def audit_log(user_action)

18
app/controllers/tags_controller.rb
View file

@ -5,6 +5,14 @@ class TagsController < ApplicationController
ATTRIBUTES_FOR_SERIALIZATION = %i[id name bg_color_hex text_color_hex].freeze
INDEX_API_ATTRIBUTES = %i[name rules_html].freeze
TAGS_ALLOWED_PARAMS = %i[
wiki_body_markdown
rules_markdown
short_summary
pretty_name
bg_color_hex
text_color_hex
].freeze
def index
skip_authorization
@ -59,16 +67,8 @@ class TagsController < ApplicationController
end
def tag_params
accessible = %i[
wiki_body_markdown
rules_markdown
short_summary
pretty_name
bg_color_hex
text_color_hex
]
convert_empty_string_to_nil
params.require(:tag).permit(accessible)
params.require(:tag).permit(TAGS_ALLOWED_PARAMS)
end
private_constant :ATTRIBUTES_FOR_SERIALIZATION