| Age | Commit message (Collapse) | Author |
|---|
|
publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.
Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.
A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.
|
|
password_required? treated a blank crypted_password as "needs a
password", but after bcrypt migration crypted_password is nil by
design -- every subsequent save of a migrated or new user failed
validation. The predicate now requires a password only when both
the legacy and the bcrypt credential are absent, or when one is
actually being set.
|
|
Add has_secure_password and bcrypt while retaining compatibility with
legacy SHA-1 password hashes. Existing users are upgraded to
password_digest on their next successful login.
Add regression tests covering both legacy and modern authentication
paths.
|
|
|
|
- routing-filter 0.6.3 -> 0.7.0 (Rails 6.1 compatibility)
- RSS named routes rss_xml/rss_rdf added
- RouteWithParams workarounds: will_paginate_patch, content_path shim, safe_path helper
- Paperclip removed, replaced with FileAttachment concern (preserves URL scheme)
- Assets resource moved to /admin/assets (Sprockets middleware conflict)
- ApplicationRecord base class added, all models migrated
- Strong parameters added to Assets, Occurrences, Events, MenuItems controllers
- update_attributes -> update throughout
- render :nothing -> head :ok/:not_found throughout
- language_selector rewritten (removes :overwrite_params)
- Environment files updated for Rails 6.1 (eager_load, public_file_server, ActionMailer)
- Arel::Visitors::DepthFirst and Integer/Float duration patches removed from test_helper
- AssetsController tests added (10 tests covering upload, variants, destroy, auth)
- ImageMagick geometry: 460x250! for headline crop (not # which is invalid in IM6)
129 runs, 311 assertions, 5 failures (all pre-existing), 0 errors
|
|
- Rename test/functional → test/controllers, test/unit → test/models
- Remove test/performance/browsing_test.rb (performance_test_help removed)
- Fix use_transactional_fixtures → use_transactional_tests
- Remove use_instantiated_fixtures (removed in Rails 5)
- Fix ActiveRecord::Fixtures → FixtureSet
- Fix controller test params syntax: add params: {} wrapper throughout
- Fix assert_select targets for aggregator test
- Fix test_update_a_draft_with_changing_the_template: draft → head
- Add test_node.reload after children.create! (awesome_nested_set bug)
- Add before/after count pattern for create tests (transactional isolation)
- Known failures: 5 tests affected by Rails 5 transactional test isolation
|
