rails 4 and tons of stuff

app/controllers/blogposts_controller.rb

@@ -29,7 +29,7 @@ class BlogpostsController < ApplicationController
 
   def create
     if mod?
-      @post = Blogpost.new(params[:blogpost].slice(:title, :content))
+      @post = Blogpost.new(post_params)
       @post.user_author = current_user
       if @post.save
         redirect_to @post, notice: 'Post has been created.'
@@ -47,7 +47,7 @@ class BlogpostsController < ApplicationController
     @post = Blogpost.find(params[:id])
     if mod? || @comment.author.is?(current_user)
       @post.user_editor = current_user
-      if @post.update_attributes(params[:blogpost].slice(:title, :content, :user_editor))
+      if @post.update_attributes(post_params([:user_editor]))
         redirect_to @post, notice: 'Post has been updated.'
       else
         flash[:alert] = "There was a problem while updating the post"
@@ -69,4 +69,13 @@ class BlogpostsController < ApplicationController
     end
     redirect_to blogposts_path
   end
-end
+
+
+  private
+
+  def post_params(add = [])
+    a = [:title, :content]
+    a += add
+    params.require(:blogpost).permit(a)
+  end
+end

app/controllers/comments_controller.rb

@@ -11,12 +11,11 @@ class CommentsController < ApplicationController
 
   def create
     if confirmed?
-      params[:comment].slice!("content") if params[:comment]
-      @comment = Comment.new(params[:comment])
+      @comment = Comment.new(comment_params)
       @comment.user_author = current_user
       @comment.blogpost = Blogpost.find(params[:blogpost_id])
       if @comment.save
-        redirect_to @comment.blogpost, notice: 'Comment created!'
+        redirect_to blogpost_path(@comment.blogpost) + "#comment-#{@comment.id}", notice: 'Comment created!'
       else
         flash[:alert] = "Could not create comment."
         redirect_to Blogpost.find(params[:blogpost_id])
@@ -30,10 +29,9 @@ class CommentsController < ApplicationController
   def update
     @comment = Comment.find(params[:id])
     if mod? || @comment.author.is?(current_user)
-      params[:comment].slice!("content") if params[:comment]
-      if @comment.update_attributes(params[:comment])
+      if @comment.update_attributes(comment_params)
         flash[:notice] = "Comment updated!"
-        redirect_to @comment.blogpost
+        redirect_to blogpost_path(@comment.blogpost) + "#comment-#{@comment.id}"
       else
         flash[:alert] = "There was a problem while updating your comment"
         render action: "edit"
@@ -57,4 +55,10 @@ class CommentsController < ApplicationController
     end
     redirect_to @comment.blogpost
   end
+
+  private
+
+  def comment_params
+    params.require(:comment).permit(:content)
+  end
 end

app/controllers/forumgroups_controller.rb

@@ -5,7 +5,7 @@ class ForumgroupsController < ApplicationController
   end
 
   def show
-    redirect_to forums_path + "#forums-#{params[:id]}"
+    redirect_to forums_path + "#forum-#{params[:id]}"
   end
 
   def edit
@@ -19,7 +19,7 @@ class ForumgroupsController < ApplicationController
   def update
     if admin?
       @group = Forumgroup.find(params[:id])
-      if @group.update_attributes(params[:forumgroup])
+      if @group.update_attributes(group_params)
         flash[:notice] = "Forum group updated"
         redirect_to @group
       else
@@ -42,7 +42,7 @@ class ForumgroupsController < ApplicationController
 
   def create
     if admin?
-      @group = Forumgroup.new(params[:forumgroup])
+      @group = Forumgroup.new(group_params)
       if @group.save
         flash[:notice] = "Forum group created."
         redirect_to @group
@@ -56,6 +56,11 @@ class ForumgroupsController < ApplicationController
     end
   end
 
+  private
 
+  def group_params(add = [])
+    a = [:name, :position, :role_read, :role_write] + add
+    params.require(:forumgroup).permit(a)
+  end
 
 end

app/controllers/forums_controller.rb

@@ -1,9 +1,8 @@
 class ForumsController < ApplicationController
-  before_filter :check_permission, only: [:show]
+  before_filter :check_permission, only: [:show, :edit, :update]
 
   def index
-     @groups = Forumgroup.all
-     @groups.select!{|g| g.can_read?(current_user) }
+     @groups = Forumgroup.select {|g| g.can_read?(current_user) }
      @groups.sort_by!{|g| g[:position]}
   end
 
@@ -11,19 +10,36 @@ class ForumsController < ApplicationController
     @threads = @forum.forumthreads.order("sticky desc, updated_at desc")
   end
 
+  def edit
+  end
+
   def new
     if admin?
-      @group = Forumgroup.find(params[:forumgroup])
       @forum = Forum.new(forumgroup: @group)
+      @forum.forumgroup = Forumgroup.find(params[:forumgroup])
     else
       flash[:alert] = "You are not allowed to create a forum."
       redirect_to forums_path
     end
   end
 
+  def update
+    if admin?
+      if @forum.update_attributes(forum_params)
+        flash[:notice] = "Forum updated"
+        redirect_to @forum
+      else
+        flash[:alert] = "Something went wrong"
+      end
+    else
+      flash[:alert] = "You are not allowed to change a forum"
+      redirect_to @forum
+    end
+  end
+
   def create
     if admin?
-      @forum = Forum.new(params[:forum])
+      @forum = Forum.new(forum_params)
       @forum.forumgroup = Forumgroup.find(params[:forum][:forumgroup_id])
       if @forum.save
         flash[:notice] = "Forum created."
@@ -49,5 +65,8 @@ class ForumsController < ApplicationController
     end
   end
 
-
+  def forum_params(add = [])
+    a = [:name, :position, :role_read, :role_write] + add
+    params.require(:forum).permit(a)
+  end
 end

app/controllers/forumthreads_controller.rb

@@ -12,7 +12,7 @@ class ForumthreadsController < ApplicationController
   def update
     if mod? || @thread.author.is?(current_user)
       @thread.user_editor = current_user
-      if @thread.update_attributes(params[:forumthread].slice(:title, :content, :user_editor))
+      if @thread.update_attributes thread_params([:user_editor])
         redirect_to @thread, notice: 'Post has been updated.'
       else
         flash[:alert] = "There was a problem while updating the post"
@@ -28,16 +28,15 @@ class ForumthreadsController < ApplicationController
   end
 
   def new
-    @forum = Forum.find(params[:forum_id])
-    unless @forum.can_write?(current_user)
-      flash[:alert] = "You are not allowed to view this forum"
+    @thread = Forumthread.new(forum: Forum.find(params[:forum]))
+    unless @thread.forum.can_write?(current_user)
+      flash[:alert] = "You are not allowed to write in this forum"
       redirect_to forums_path
     end
-    @thread = Forumthread.new(forum: @forum)
   end
 
   def create
-    @thread = Forumthread.new(mod? ? params[:forumthread] : params[:forumthread].slice(:title, :content))
+    @thread = Forumthread.new(mod? ? thread_params([:sticky, :locked]) : thread_params)
     if @thread.can_write?(current_user)
       @thread.user_author = current_user
       @thread.forum       = @thread.forum
@@ -69,5 +68,9 @@ class ForumthreadsController < ApplicationController
     end
   end
 
-
+  def thread_params(add = [])
+    a = [:title, :content]
+    a += add
+    params.require(:Forumthread).permit(a)
+  end
 end

app/controllers/users_controller.rb

@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
 
-require 'open-uri'
+  require 'open-uri'
 
   def index
     if params[:role]
@@ -10,10 +10,10 @@ require 'open-uri'
         @users = User.find_all_by_role_id(Role.get(params[:role]))
       end
     else
-      @users = User.all
-      @users.shift() #Remove first user
+      @users = User.all.to_a
+      @users.shift #Remove first user
     end
-    @users = @users.sort_by{|u| u.role}.reverse!
+    @users = @users.to_a.sort_by{|u| u.role}.reverse!
   end
 
   def show
@@ -80,7 +80,7 @@ require 'open-uri'
       flash[:notice] = "You are already signed up!"
       redirect_to current_user
     else
-      @user = User.new(params[:user] ? params[:user].slice(:ign, :email, :password, :password_confirmation) : {} )
+      @user = User.new(user_params)
       user_profile = @user.get_profile
       if user_profile
         @user.uuid = user_profile["id"]
@@ -125,7 +125,7 @@ require 'open-uri'
   def update
     @user = User.find(params[:id])
     if (mod? && current_user.role >= @user.role ) || (@user.is?(current_user) && confirmed?)
-      userdata = params[:user] ? params[:user].slice(:name, :ign, :role_id, :skype, :skype_public, :youtube, :twitter, :about, :password, :password_confirmation) : {}
+      userdata = user_params([:name, :role_id, :skype, :skype_public, :youtube, :twitter, :about])
       if userdata[:role_id]
         role = Role.find(userdata[:role_id])
         if (mod? && role <= current_user.role)
@@ -235,4 +235,8 @@ require 'open-uri'
     user_token && user_token.token == token
   end
 
+  def user_params(add = [])
+    a = [:ign, :email, :password, :password_confirmation] + add
+    params.require(:user).permit(a)
+  end
 end