Rails 4.2 model and controller fixes

- Wrap all scopes in lambdas (required in Rails 4)
- Move scopes after associations in page.rb (evaluated at load time in Rails 4)
- Convert association :order options to lambda syntax
- Remove attr_accessible from page.rb and user.rb
- Add Strong Parameters: user_params in UsersController, node_params/page_params in NodesController
- Fix clone_attributes_from: exclude id/page_id/timestamps when cloning translations
- Fix redirect_to :back → request.referer fallback in nodes_controller
- Fix node_path/publish and unlock actions: pass @node argument

2 files changed, 24 insertions, 9 deletions

diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index 7c082c4..2b36b78 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -21,7 +21,7 @@ class NodesController < ApplicationController
   end
 
   def new
-    @node = Node.new params[:node]
+    @node = Node.new node_params
     if params.has_key?(:parent_id)
       @parent_id = params[:parent_id]
       @parent_name = Node.find(@parent_id).title
@@ -62,7 +62,7 @@ class NodesController < ApplicationController
     rescue LockedByAnotherUser => e
       flash[:error] = e.message
       if request.referer
-        redirect_to :back
+        redirect_to request.referer || node_path(@node)
       else
         redirect_to node_path(@node)
       end
@@ -70,10 +70,10 @@ class NodesController < ApplicationController
   end
 
   def update
-    @node.update_attributes(params[:node])
+    @node.update_attributes(node_params)
     @draft = @node.find_or_create_draft current_user
     @draft.tag_list = params[:tag_list]
-    if @draft.update_attributes( params[:page] )
+    if @draft.update_attributes( page_params )
       flash[:notice] = "Draft has been saved: #{Time.now}"
       respond_to do |format|
         format.html { redirect_to edit_node_path(@node) }
@@ -91,7 +91,7 @@ class NodesController < ApplicationController
   def publish
     @node.publish_draft!
     flash[:notice] = "Draft has been published"
-    redirect_to node_path
+    redirect_to node_path(@node)
   end
   
   def unlock
@@ -105,6 +105,14 @@ class NodesController < ApplicationController
   end
   
   private
+
+    def node_params
+      params.fetch(:node, {}).permit(:slug, :parent_id)
+    end
+
+    def page_params
+      params.fetch(:page, {}).permit(:title, :abstract, :body, :template_name, :published_at, :user_id)
+    end
   
     def find_node
       @node = Node.find(params[:id])
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index b7914c4..1d85690 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -15,11 +15,11 @@ class UsersController < ApplicationController
   end
 
   def new
-    @user = User.new( params[:user] )
+    @user = User.new
   end
 
   def create
-    @user = User.new params[:user]
+    @user = User.new user_params
 
     if @user.save
       flash[:notice] = "User created #{@user.login}"
@@ -33,8 +33,10 @@ class UsersController < ApplicationController
   end
 
   def update
-    params[:user].delete(:admin) unless current_user.is_admin?
-    if @user.update_attributes(params[:user])
+    permitted = user_params
+    permitted.delete(:admin) unless current_user.is_admin?
+            
+    if @user.update_attributes(permitted)
       flash[:notice] = "Updated user #{@user.login}"
       redirect_to user_path(@user)
     else
@@ -51,6 +53,11 @@ class UsersController < ApplicationController
   end
 
   private
+
+    def user_params
+      params.fetch(:user, {}).permit(:login, :email, :password, :password_confirmation, :admin)
+    end
+
     def find_user
       @user = User.find(params[:id])
     end