Stage 4: Rails 5.2 -> 6.1 on Ruby 2.7.2

- routing-filter 0.6.3 -> 0.7.0 (Rails 6.1 compatibility)
- RSS named routes rss_xml/rss_rdf added
- RouteWithParams workarounds: will_paginate_patch, content_path shim, safe_path helper
- Paperclip removed, replaced with FileAttachment concern (preserves URL scheme)
- Assets resource moved to /admin/assets (Sprockets middleware conflict)
- ApplicationRecord base class added, all models migrated
- Strong parameters added to Assets, Occurrences, Events, MenuItems controllers
- update_attributes -> update throughout
- render :nothing -> head :ok/:not_found throughout
- language_selector rewritten (removes :overwrite_params)
- Environment files updated for Rails 6.1 (eager_load, public_file_server, ActionMailer)
- Arel::Visitors::DepthFirst and Integer/Float duration patches removed from test_helper
- AssetsController tests added (10 tests covering upload, variants, destroy, auth)
- ImageMagick geometry: 460x250! for headline crop (not # which is invalid in IM6)

129 runs, 311 assertions, 5 failures (all pre-existing), 0 errors

8 files changed, 48 insertions, 24 deletions

diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb
index a11bbdd..d150e06 100644
--- a/app/controllers/assets_controller.rb
+++ b/app/controllers/assets_controller.rb
@@ -7,10 +7,9 @@ class AssetsController < ApplicationController
   layout 'admin'
   
   def index
-    @assets = Asset.all.paginate(
-      :page => params[:page], 
-      :per_page => 20,
-      :order => 'id DESC'
+    @assets = Asset.order('id DESC').paginate(
+      :page     => params[:page],
+      :per_page => 20
     )
   end
 
@@ -44,7 +43,7 @@ class AssetsController < ApplicationController
   # POST /assets
   # POST /assets.xml
   def create
-    @asset = Asset.new(params[:asset])
+    @asset = Asset.new(asset_params)
 
     respond_to do |format|
       if @asset.save
@@ -64,7 +63,7 @@ class AssetsController < ApplicationController
     @asset = Asset.find(params[:id])
 
     respond_to do |format|
-      if @asset.update_attributes(params[:asset])
+      if @asset.update(asset_params)
         flash[:notice] = 'Asset was successfully updated.'
         format.html { redirect_to(@asset) }
         format.xml  { head :ok }
@@ -86,4 +85,10 @@ class AssetsController < ApplicationController
       format.xml  { head :ok }
     end
   end
+
+  private
+
+    def asset_params
+      params.require(:asset).permit(:name, :upload)
+    end
 end
diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 876bccf..8d33105 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -15,13 +15,14 @@ class ContentController < ApplicationController
 
     if @page and @page.public?
       render(
-        :file => @page.valid_template,
+        :template => @page.valid_template,
         :layout => true
       )
     else
       render(
-        :file => Rails.root.join('public', '404.html'),
-        :status => 404
+        :file => Rails.root.join('public', '404.html').to_s,
+        :status => 404,
+        :layout => false
       )
     end
 
@@ -32,7 +33,7 @@ class ContentController < ApplicationController
       @images = @page.assets.images
       render :file => "content/gallery"
     else
-      render :nothing => true, :status => 404
+      head :not_found
     end
   end
 
diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb
index 6eba476..7695e9b 100644
--- a/app/controllers/events_controller.rb
+++ b/app/controllers/events_controller.rb
@@ -47,7 +47,7 @@ class EventsController < ApplicationController
   # POST /events
   # POST /events.xml
   def create
-    @event = Event.new(params[:event])
+    @event = Event.new(event_params)
 
     respond_to do |format|
       if @event.save
@@ -67,7 +67,7 @@ class EventsController < ApplicationController
     @event = Event.find(params[:id])
 
     respond_to do |format|
-      if @event.update_attributes(params[:event])
+      if @event.update(event_params)
         flash[:notice] = 'Event was successfully updated.'
         format.html { redirect_to(edit_node_path(@event.node)) }
         format.xml  { head :ok }
@@ -89,4 +89,10 @@ class EventsController < ApplicationController
       format.xml  { head :ok }
     end
   end
+
+  private
+
+    def event_params
+      params.require(:event).permit(:start_time, :end_time, :rrule, :custom_rrule, :allday, :url, :latitude, :longitude, :node_id, :location)
+    end
 end
diff --git a/app/controllers/menu_items_controller.rb b/app/controllers/menu_items_controller.rb
index 4018693..1b1eb59 100644
--- a/app/controllers/menu_items_controller.rb
+++ b/app/controllers/menu_items_controller.rb
@@ -14,11 +14,11 @@ class MenuItemsController < ApplicationController
   end
 
   def new
-    @menu_item = MenuItem.new params[:menu_item]
+    @menu_item = MenuItem.new menu_item_params
   end
 
   def create
-    if MenuItem.create( params[:menu_item] )
+    if MenuItem.create( menu_item_params )
       redirect_to menu_items_path
     else
       render :new
@@ -32,7 +32,7 @@ class MenuItemsController < ApplicationController
   def update
     @menu_item = MenuItem.find( params[:id] )
     
-    if @menu_item.update_attributes( params[:menu_item] )
+    if @menu_item.update( menu_item_params )
       redirect_to menu_items_path
     else
       render :edit
@@ -48,10 +48,15 @@ class MenuItemsController < ApplicationController
   def sort
     params[:menu_items].each_with_index do |item_id, index|
       menu_item = MenuItem.find(item_id)
-      menu_item.update_attributes(:position => index + 1)
+      menu_item.update(:position => index + 1)
     end
     
-    render :nothing => true
+    head :ok
   end
 
+  private
+
+    def menu_item_params
+      params.require(:menu_item).permit(:node_id, :path, :position, :type, :type_id)
+    end
 end
diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index 482d0ac..bd60b27 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -36,7 +36,7 @@ class NodesController < ApplicationController
     @node.slug = params[:title].parameterize.to_s
    
     if @node.save
-      @node.draft.update_attributes(:title => params[:title])
+      @node.draft.update(:title => params[:title])
       case params[:kind]
         when "update"
           @node.draft.tag_list.add("update")
@@ -70,10 +70,10 @@ class NodesController < ApplicationController
   end
 
   def update
-    @node.update_attributes(node_params)
+    @node.update(node_params)
     @draft = @node.find_or_create_draft current_user
     @draft.tag_list = params[:tag_list]
-    if @draft.update_attributes( page_params )
+    if @draft.update( page_params )
       flash[:notice] = "Draft has been saved: #{Time.now}"
       respond_to do |format|
         format.html { redirect_to edit_node_path(@node) }
diff --git a/app/controllers/occurrences_controller.rb b/app/controllers/occurrences_controller.rb
index 61b42ff..0f30ce3 100644
--- a/app/controllers/occurrences_controller.rb
+++ b/app/controllers/occurrences_controller.rb
@@ -45,7 +45,7 @@ class OccurrencesController < ApplicationController
   # POST /occurrences
   # POST /occurrences.xml
   def create
-    @occurrence = Occurrence.new(params[:occurrence])
+    @occurrence = Occurrence.new(occurrence_params)
 
     respond_to do |format|
       if @occurrence.save
@@ -65,7 +65,7 @@ class OccurrencesController < ApplicationController
     @occurrence = Occurrence.find(params[:id])
 
     respond_to do |format|
-      if @occurrence.update_attributes(params[:occurrence])
+      if @occurrence.update(occurrence_params)
         flash[:notice] = 'Occurrence was successfully updated.'
         format.html { redirect_to(@occurrence) }
         format.xml  { head :ok }
@@ -87,4 +87,11 @@ class OccurrencesController < ApplicationController
       format.xml  { head :ok }
     end
   end
+
+  private
+
+    def occurrence_params
+      params.require(:occurrence).permit(:start_time, :end_time, :node_id, :event_id)
+    end
+
 end
diff --git a/app/controllers/pages_controller.rb b/app/controllers/pages_controller.rb
index f5609eb..a40bf10 100644
--- a/app/controllers/pages_controller.rb
+++ b/app/controllers/pages_controller.rb
@@ -22,6 +22,6 @@ class PagesController < ApplicationController
     page = Page.find(params[:id])
     page.update_assets(params[:images])
     
-    render :nothing => true, :status => 200
+    head :ok
   end
 end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 72e6058..98fd534 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -36,7 +36,7 @@ class UsersController < ApplicationController
     permitted = user_params
     permitted.delete(:admin) unless current_user.is_admin?
             
-    if @user.update_attributes(permitted)
+    if @user.update(permitted)
       flash[:notice] = "Updated user #{@user.login}"
       redirect_to user_path(@user)
     else