Rails 4.2 model and controller fixes

- Wrap all scopes in lambdas (required in Rails 4)
- Move scopes after associations in page.rb (evaluated at load time in Rails 4)
- Convert association :order options to lambda syntax
- Remove attr_accessible from page.rb and user.rb
- Add Strong Parameters: user_params in UsersController, node_params/page_params in NodesController
- Fix clone_attributes_from: exclude id/page_id/timestamps when cloning translations
- Fix redirect_to :back → request.referer fallback in nodes_controller
- Fix node_path/publish and unlock actions: pass @node argument

7 files changed, 19 insertions, 23 deletions

diff --git a/app/models/asset.rb b/app/models/asset.rb
index 3ad5857..f6526f2 100644
--- a/app/models/asset.rb
+++ b/app/models/asset.rb
@@ -13,8 +13,9 @@ class Asset < ActiveRecord::Base
       :headline => "460x250#"
     }
   )
- 
-  scope :images,    where(:upload_content_type => ["image/gif", "image/jpeg", "image/png"])
-  scope :documents, where(:upload_content_type => ["application/pdf", "text/plain", "text/rtf"])
-  scope :audio,     where(:upload_content_type => ["audio/mpeg", "audio/x-m4a", "audio/wav", "audio/x-wav"])
+
+  scope :images,    -> { where(:upload_content_type => ["image/gif", "image/jpeg", "image/png"]) }
+  scope :documents, -> { where(:upload_content_type => ["application/pdf", "text/plain", "text/rtf"]) }
+  scope :audio,     -> { where(:upload_content_type => ["audio/mpeg", "audio/x-m4a", "audio/wav", "audio/x-wav"]) }
+
 end
diff --git a/app/models/menu_item.rb b/app/models/menu_item.rb
index d1ddc68..eb82347 100644
--- a/app/models/menu_item.rb
+++ b/app/models/menu_item.rb
@@ -1,6 +1,6 @@
 class MenuItem < ActiveRecord::Base
  
-  default_scope where(:type => "MenuItem")
+  default_scope -> { where(:type => "MenuItem") }
   
   translates    :title
   
@@ -24,5 +24,5 @@ end
 
 
 class FeaturedArticle < MenuItem
-  default_scope where(:type => "FeaturedArticle")
+  default_scope -> { where(:type => "FeaturedArticle") }
 end
diff --git a/app/models/node.rb b/app/models/node.rb
index 3cab7ed..8be6daf 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -3,7 +3,7 @@ class Node < ActiveRecord::Base
   acts_as_nested_set
 
   # Associations
-  has_many    :pages, :order => "revision ASC", :dependent => :destroy
+  has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
   belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy
   belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy
   has_many    :permissions, :dependent => :destroy
diff --git a/app/models/page.rb b/app/models/page.rb
index 5c93a93..e2cbee5 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -5,10 +5,6 @@ class Page < ActiveRecord::Base
   PUBLIC_TEMPLATE_PATH = File.join(%w(custom page_templates public))
   FULL_PUBLIC_TEMPLATE_PATH = Rails.root.join('app', 'views', PUBLIC_TEMPLATE_PATH)
 
-  # named scopes
-  scope :drafts, joins(:node).includes(:translations).where("nodes.draft_id = pages.id")
-  scope :heads,  joins(:node).includes(:translations).where("nodes.head_id = pages.id")
-
   # Mixins and Plugins
   acts_as_taggable
   acts_as_list :column => :revision, :scope => :node_id
@@ -20,16 +16,17 @@ class Page < ActiveRecord::Base
   belongs_to :user
   belongs_to :editor, :class_name => "User"
   has_many   :related_assets
-  has_many   :assets, :through => :related_assets, :order => "position ASC"
+  has_many   :assets, -> { order("position ASC") }, :through => :related_assets
+
+  # Named scopes
+  scope :drafts, -> { joins(:node).includes(:translations).where("nodes.draft_id = pages.id") }
+  scope :heads,  -> { joins(:node).includes(:translations).where("nodes.head_id = pages.id") }
 
   # Filter
   before_create :set_page_title
   before_create :set_template
   before_save   :rewrite_links_in_body
 
-  # Security
-  attr_accessible :title, :abstract, :body, :template_name, :published_at, :user_id
-
   # Class Methods
 
   # This method is most likely called from the ContentHelper.render_collection
@@ -146,7 +143,7 @@ class Page < ActiveRecord::Base
 
     # Clone translated attributes
     page.translations.each do |translation|
-      self.translations.create!(translation.attributes)
+      self.translations.create!(translation.attributes.except("id", "page_id", "created_at", "updated_at"))
     end
 
     # Clone asset references
diff --git a/app/models/permission.rb b/app/models/permission.rb
index a7a30ed..f304538 100644
--- a/app/models/permission.rb
+++ b/app/models/permission.rb
@@ -8,6 +8,6 @@ class Permission < ActiveRecord::Base
   belongs_to :node
   
   # Named scopes
-  scope :for_node, lambda { |node| where('node_id = ?', (node.is_a?(Node) ? node.id : node)) }
-  scope :for_user, lambda { |user| where('user_id = ?', (user.is_a?(User) ? user.id : user)) }
+  scope :for_node, ->(node) { where('node_id = ?', (node.is_a?(Node) ? node.id : node)) }
+  scope :for_user, ->(user) { where('user_id = ?', (user.is_a?(User) ? user.id : user)) }
 end
diff --git a/app/models/related_asset.rb b/app/models/related_asset.rb
index af09420..2b61c51 100644
--- a/app/models/related_asset.rb
+++ b/app/models/related_asset.rb
@@ -3,6 +3,6 @@ class RelatedAsset < ActiveRecord::Base
   belongs_to :asset
   
   acts_as_list :scope => :page_id
-  
-  default_scope :order => "position ASC"
-end
\ No newline at end of file
+
+  default_scope -> { order("position ASC") }
+end
diff --git a/app/models/user.rb b/app/models/user.rb
index ce5503f..a2540b5 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -21,8 +21,6 @@ class User < ActiveRecord::Base
   validates_format_of       :email, :with => Authentication.email_regex,
                             :message => Authentication.bad_email_message
 
-  attr_accessible :login, :email, :password, :password_confirmation, :admin
-
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
     return nil if login.blank? || password.blank?