diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index dbaa9e797..ce277b360 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -21,7 +21,7 @@ class UsersController < ApplicationController @tab_list = @user.settings_tab_list @tab = params["user"]["tab"] || "profile" authorize @user - if @user.update(user_params) + if @user.update(permitted_attributes(@user)) RssReader.new.delay.fetch_user(@user) if @user.feed_url.present? notice = "Your profile was successfully updated." follow_hiring_tag(@user) @@ -116,58 +116,4 @@ class UsersController < ApplicationController end end end - - private - - def user_params - accessible = %i[name - email - username - profile_image - website_url - summary - email_newsletter - email_digest_periodic - email_membership_newsletter - email_comment_notifications - email_mention_notifications - email_follower_notifications - email_badge_notifications - email_unread_notifications - bg_color_hex - text_color_hex - employer_name - employer_url - employment_title - currently_learning - available_for - mostly_work_with - currently_hacking_on - location - email_public - education - looking_for_work - looking_for_work_publicly - contact_consent - feed_url - feed_mark_canonical - prefer_language_en - prefer_language_ja - prefer_language_es - prefer_language_fr - prefer_language_it - display_sponsors - permit_adjacent_sponsors - feed_admin_publish_permission] - accessible << %i[password password_confirmation] unless params[:user][:password].blank? - params.require(:user). - permit(accessible). - transform_values do |value| - if value.class.name == "String" - ActionController::Base.helpers.strip_tags(value) - else - value - end - end - end end diff --git a/app/models/user.rb b/app/models/user.rb index c2a90c40e..272b210af 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -1,6 +1,6 @@ -include CloudinaryHelper - class User < ApplicationRecord + include CloudinaryHelper + attr_accessor :scholar_email rolify include AlgoliaSearch @@ -56,15 +56,15 @@ class User < ApplicationRecord validates :employer_url, url: { allow_blank: true, no_local: true, schemes: ["https", "http"] } validates :shirt_gender, inclusion: { in: %w(unisex womens), - message: "%{value} is not a valid shirt style" }, + message: "%{value} is not a valid shirt style" }, allow_blank: true validates :shirt_size, inclusion: { in: %w(xs s m l xl 2xl 3xl 4xl), - message: "%{value} is not a valid size" }, + message: "%{value} is not a valid size" }, allow_blank: true validates :tabs_or_spaces, inclusion: { in: %w(tabs spaces), - message: "%{value} is not a valid answer" }, + message: "%{value} is not a valid answer" }, allow_blank: true validates :shipping_country, length: { in: 2..2 }, @@ -87,7 +87,6 @@ class User < ApplicationRecord before_validation :set_username before_validation :downcase_email before_validation :check_for_username_change - before_validation :unescape_summary algoliasearch per_environment: true, enqueue: :trigger_delayed_index do attribute :name @@ -129,7 +128,7 @@ class User < ApplicationRecord def self.trigger_delayed_index(record, remove) if remove - record.delay.remove_from_index! if (record && record.persisted?) + record.delay.remove_from_index! if record&.persisted? else record.delay.index! end @@ -146,28 +145,29 @@ class User < ApplicationRecord def estimate_default_language! identity = identities.where(provider: "twitter").first if email.end_with?(".jp") - self.update(:estimated_default_language => "ja", :prefer_language_ja => true) + update(estimated_default_language: "ja", prefer_language_ja: true) elsif identity lang = identity.auth_data_dump["extra"]["raw_info"]["lang"] - self.update(:estimated_default_language => lang, "prefer_language_#{lang}" => true) + update(:estimated_default_language => lang, + "prefer_language_#{lang}" => true) end end handle_asynchronously :estimate_default_language! def calculate_score - score = (articles.where(featured:true).size*100) + (comments.sum(:score)) - self.update_column(:score, score) + score = (articles.where(featured: true).size * 100) + comments.sum(:score) + update_column(:score, score) end def path - "/"+username.to_s + "/" + username.to_s end def followed_articles Article.tagged_with(cached_followed_tag_names, any: true).union( Article.where( user_id: cached_following_users_ids, - ) + ), ).where(language: cached_preferred_langs, published: true) end @@ -203,8 +203,14 @@ class User < ApplicationRecord end def cached_followed_tag_names - Rails.cache.fetch("user-#{id}-#{updated_at}/followed_tag_names", expires_in: 100.hours) do - Tag.where(id:Follow.where(follower_id:id,followable_type:"ActsAsTaggableOn::Tag").pluck(:followable_id)).pluck(:name) + cache_name = "user-#{id}-#{updated_at}/followed_tag_names" + Rails.cache.fetch(cache_name, expires_in: 100.hours) do + Tag.where( + id: Follow.where( + follower_id: id, + followable_type: "ActsAsTaggableOn::Tag", + ).pluck(:followable_id), + ).pluck(:name) end end @@ -300,15 +306,8 @@ class User < ApplicationRecord tab_list end - - private - def unescape_summary - return unless summary.present? - self.summary = CGI.unescapeHTML(summary) - end - def send_welcome_notification Broadcast.send_welcome_notification(id) end @@ -322,9 +321,9 @@ class User < ApplicationRecord def set_temp_username self.username = if temp_name_exists? - temp_username + "_" + rand(100).to_s - else - temp_username + temp_username + "_" + rand(100).to_s + else + temp_username end end @@ -335,7 +334,7 @@ class User < ApplicationRecord def temp_username if twitter_username twitter_username.downcase.gsub(/[^0-9a-z_]/i, "").gsub(/ /, "") - elsif github_username + elsif github_username github_username.downcase.gsub(/[^0-9a-z_]/i, "").gsub(/ /, "") end end diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb index f62b8e403..fa01ea2f7 100644 --- a/app/policies/user_policy.rb +++ b/app/policies/user_policy.rb @@ -39,6 +39,50 @@ class UserPolicy < ApplicationPolicy user.has_role?(:trusted) && !user.banned end + def permitted_attributes + %i[available_for + bg_color_hex + contact_consent + currently_hacking_on + currently_learning + display_sponsors + education + email + email_badge_notifications + email_comment_notifications + email_digest_periodic + email_follower_notifications + email_membership_newsletter + email_mention_notifications + email_newsletter + email_public + email_unread_notifications + employer_name + employer_url + employment_title + feed_admin_publish_permission + feed_mark_canonical + feed_url + location + looking_for_work + looking_for_work_publicly + mostly_work_with + name + permit_adjacent_sponsors + password + password_confirmation + prefer_language_en + prefer_language_es + prefer_language_fr + prefer_language_it + prefer_language_ja + profile_image + summary + text_color_hex + username + website_url] + end + private def within_the_same_org?