diff --git a/app/controllers/admin/articles_controller.rb b/app/controllers/admin/articles_controller.rb index 9750616dd..d1b1240db 100644 --- a/app/controllers/admin/articles_controller.rb +++ b/app/controllers/admin/articles_controller.rb @@ -6,6 +6,19 @@ module Admin Audit::Logger.log(:moderator, current_user, params.dup) end + ARTICLES_ALLOWED_PARAMS = %i[featured + social_image + body_markdown + approved + email_digest_eligible + boosted_additional_articles + boosted_dev_digest_email + main_image_background_hex_color + featured_number + user_id + co_author_ids_list + published_at].freeze + def index @pinned_article = PinnedArticle.get @@ -103,19 +116,7 @@ module Admin end def article_params - allowed_params = %i[featured - social_image - body_markdown - approved - email_digest_eligible - boosted_additional_articles - boosted_dev_digest_email - main_image_background_hex_color - featured_number - user_id - co_author_ids_list - published_at] - params.require(:article).permit(allowed_params) + params.require(:article).permit(ARTICLES_ALLOWED_PARAMS) end def authorize_admin diff --git a/app/controllers/admin/chat_channels_controller.rb b/app/controllers/admin/chat_channels_controller.rb index 69e86699b..4a585f539 100644 --- a/app/controllers/admin/chat_channels_controller.rb +++ b/app/controllers/admin/chat_channels_controller.rb @@ -2,6 +2,8 @@ module Admin class ChatChannelsController < Admin::ApplicationController layout "admin" + CHAT_ALLOWED_PARAMS = %i[usernames_string channel_name username_string].freeze + def index @q = ChatChannel.where(channel_type: "invite_only").includes(:users).ransack(params[:q]) @group_chat_channels = @q.result.page(params[:page]).per(50) @@ -51,8 +53,7 @@ module Admin end def chat_channel_params - allowed_params = %i[usernames_string channel_name username_string] - params.require(:chat_channel).permit(allowed_params) + params.require(:chat_channel).permit(CHAT_ALLOWED_PARAMS) end end end diff --git a/app/controllers/admin/events_controller.rb b/app/controllers/admin/events_controller.rb index 85cb1c62a..893c12973 100644 --- a/app/controllers/admin/events_controller.rb +++ b/app/controllers/admin/events_controller.rb @@ -3,6 +3,12 @@ module Admin layout "admin" include ApplicationHelper + EVENTS_ALLOWED_PARAMS = %i[ + title category event_date starts_at ends_at + location_name cover_image location_url description_markdown published + host_name profile_image live_now + ].freeze + def index @events = Event.order(starts_at: :desc).page(params[:page]).per(20) end @@ -44,12 +50,7 @@ module Admin private def event_params - allowed_params = %i[ - title category event_date starts_at ends_at - location_name cover_image location_url description_markdown published - host_name profile_image live_now - ] - params.require(:event).permit(allowed_params) + params.require(:event).permit(EVENTS_ALLOWED_PARAMS) end end end diff --git a/app/controllers/feedback_messages_controller.rb b/app/controllers/feedback_messages_controller.rb index ea683e5fd..f34869f6c 100644 --- a/app/controllers/feedback_messages_controller.rb +++ b/app/controllers/feedback_messages_controller.rb @@ -3,6 +3,7 @@ class FeedbackMessagesController < ApplicationController skip_before_action :verify_authenticity_token FLASH_MESSAGE = "Make sure the forms are filled. 🤖 Other possible errors: "\ "%s".freeze + FEEDBACK_ALLOWED_PARAMS = %i[message feedback_type category reported_url offender_id].freeze def create flash.clear @@ -61,8 +62,7 @@ class FeedbackMessagesController < ApplicationController end def feedback_message_params - allowed_params = %i[message feedback_type category reported_url offender_id] - params.require(:feedback_message).permit(allowed_params) + params.require(:feedback_message).permit(FEEDBACK_ALLOWED_PARAMS) end def rate_limit? diff --git a/app/controllers/organizations_controller.rb b/app/controllers/organizations_controller.rb index e6d21c254..7c224de3e 100644 --- a/app/controllers/organizations_controller.rb +++ b/app/controllers/organizations_controller.rb @@ -1,6 +1,31 @@ class OrganizationsController < ApplicationController after_action :verify_authorized + ORGANIZATIONS_PERMITTED_PARAMS = %i[ + id + name + summary + tag_line + slug + url + proof + profile_image + nav_image + dark_nav_image + location + company_size + tech_stack + email + story + bg_color_hex + text_color_hex + twitter_username + github_username + cta_button_text + cta_button_url + cta_body_markdown + ].freeze + def create rate_limit!(:organization_creation) @@ -74,30 +99,7 @@ class OrganizationsController < ApplicationController private def permitted_params - %i[ - id - name - summary - tag_line - slug - url - proof - profile_image - nav_image - dark_nav_image - location - company_size - tech_stack - email - story - bg_color_hex - text_color_hex - twitter_username - github_username - cta_button_text - cta_button_url - cta_body_markdown - ] + ORGANIZATIONS_PERMITTED_PARAMS end def organization_params diff --git a/app/controllers/podcasts_controller.rb b/app/controllers/podcasts_controller.rb index 8b7c7582a..6031e1360 100644 --- a/app/controllers/podcasts_controller.rb +++ b/app/controllers/podcasts_controller.rb @@ -6,6 +6,10 @@ class PodcastsController < ApplicationController around_action :skip_bullet, only: %i[create], if: -> { defined?(Bullet) } IMAGE_KEYS = %w[image pattern_image].freeze + PODCASTS_ALLOWED_PARAMS = %i[ + android_url image itunes_url main_color_hex overcast_url pattern_image + slug soundcloud_url twitter_username website_url title feed_url description + ].freeze def new @podcast = Podcast.new @@ -42,11 +46,7 @@ class PodcastsController < ApplicationController end def podcast_params - allowed_params = %i[ - android_url image itunes_url main_color_hex overcast_url pattern_image - slug soundcloud_url twitter_username website_url title feed_url description - ] - params.require(:podcast).permit(allowed_params) + params.require(:podcast).permit(PODCASTS_ALLOWED_PARAMS) end def skip_bullet diff --git a/app/controllers/poll_skips_controller.rb b/app/controllers/poll_skips_controller.rb index dd240f792..5f514ae66 100644 --- a/app/controllers/poll_skips_controller.rb +++ b/app/controllers/poll_skips_controller.rb @@ -1,6 +1,8 @@ class PollSkipsController < ApplicationController before_action :authenticate_user!, only: %i[create] + POLL_SKIPS_PERMITTED_PARAMS = %i[poll_id].freeze + def create poll = Poll.find(poll_skips_params[:poll_id]) poll.poll_skips.create_or_find_by(user_id: current_user.id) @@ -16,7 +18,6 @@ class PollSkipsController < ApplicationController private def poll_skips_params - accessible = %i[poll_id] - params.require(:poll_skip).permit(accessible) + params.require(:poll_skip).permit(POLL_SKIPS_PERMITTED_PARAMS) end end diff --git a/app/controllers/poll_votes_controller.rb b/app/controllers/poll_votes_controller.rb index 9041be468..af8a12490 100644 --- a/app/controllers/poll_votes_controller.rb +++ b/app/controllers/poll_votes_controller.rb @@ -1,6 +1,8 @@ class PollVotesController < ApplicationController before_action :authenticate_user!, only: %i[create] + POLL_VOTES_PERMITTED_PARMS = %i[poll_option_id].freeze + def show @poll = Poll.find(params[:id]) # Querying the poll instead of the poll vote @poll_vote = @poll.poll_votes.where(user_id: current_user).first @@ -25,7 +27,6 @@ class PollVotesController < ApplicationController private def poll_vote_params - accessible = %i[poll_option_id] - params.require(:poll_vote).permit(accessible) + params.require(:poll_vote).permit(POLL_VOTES_PERMITTED_PARMS) end end diff --git a/app/controllers/stripe_active_cards_controller.rb b/app/controllers/stripe_active_cards_controller.rb index 2216efa88..47d452751 100644 --- a/app/controllers/stripe_active_cards_controller.rb +++ b/app/controllers/stripe_active_cards_controller.rb @@ -5,6 +5,8 @@ class StripeActiveCardsController < ApplicationController AUDIT_LOG_CATEGORY = "user.credit_card.edit".freeze private_constant :AUDIT_LOG_CATEGORY + STRIPE_PERMITTED_PARAMS = %i[stripe_token].freeze + def create authorize :stripe_active_card @@ -87,7 +89,7 @@ class StripeActiveCardsController < ApplicationController end def stripe_params - params.permit(%i[stripe_token]) + params.permit(STRIPE_PERMITTED_PARAMS) end def audit_log(user_action) diff --git a/app/controllers/tags_controller.rb b/app/controllers/tags_controller.rb index a9f033488..89094707c 100644 --- a/app/controllers/tags_controller.rb +++ b/app/controllers/tags_controller.rb @@ -5,6 +5,14 @@ class TagsController < ApplicationController ATTRIBUTES_FOR_SERIALIZATION = %i[id name bg_color_hex text_color_hex].freeze INDEX_API_ATTRIBUTES = %i[name rules_html].freeze + TAGS_ALLOWED_PARAMS = %i[ + wiki_body_markdown + rules_markdown + short_summary + pretty_name + bg_color_hex + text_color_hex + ].freeze def index skip_authorization @@ -59,16 +67,8 @@ class TagsController < ApplicationController end def tag_params - accessible = %i[ - wiki_body_markdown - rules_markdown - short_summary - pretty_name - bg_color_hex - text_color_hex - ] convert_empty_string_to_nil - params.require(:tag).permit(accessible) + params.require(:tag).permit(TAGS_ALLOWED_PARAMS) end private_constant :ATTRIBUTES_FOR_SERIALIZATION