#472: Update Projects::CommentsController

app/controllers/projects/comments_controller.rb

@@ -27,7 +27,7 @@ class Projects::CommentsController < Projects::BaseController
 
   def update
     respond_to do |format|
-      if @comment.update_attributes(params[:comment])
+      if @comment.update_attributes(comment_params)
         format.json { render json: {message:t('flash.comment.updated'), body: view_context.markdown(@comment.body)} }
       else
         format.json { render json: {message:t('flash.comment.error_in_updating')}, status: 422 }
@@ -48,6 +48,10 @@ class Projects::CommentsController < Projects::BaseController
 
   protected
 
+  def comment_params
+    subject_params(Comment)
+  end
+
   def find_commentable
     @commentable = params[:issue_id].present? && @project.issues.find_by(serial_id: params[:issue_id]) ||
                    params[:commit_id].present? && @project.repo.commit(params[:commit_id])
@@ -55,7 +59,7 @@ class Projects::CommentsController < Projects::BaseController
 
   def find_or_build_comment
     @comment = params[:id].present? && Comment.where(automatic: false).find(params[:id]) ||
-               current_user.comments.build(params[:comment]) {|c| c.commentable = @commentable; c.project = @project}
+               current_user.comments.build(comment_params) {|c| c.commentable = @commentable; c.project = @project}
     authorize @comment
   end
 end

app/models/comment.rb

@@ -22,8 +22,6 @@ class Comment < ActiveRecord::Base
   after_create :subscribe_on_reply, unless: ->(c) { c.commit_comment? }
   after_create :subscribe_users
 
-  # attr_accessible :body, :data
-
   def commentable
     commit_comment? ? project.repo.commit(Comment.hex_to_commit_hash commentable_id) : super
   end

app/models/subscribe.rb

@@ -3,7 +3,6 @@ class Subscribe < ActiveRecord::Base
   belongs_to :user
   belongs_to :project
 
-  # attr_accessible :status, :user_id
   validates :user, presence: true
 
   def commit_subscribe?
@@ -38,7 +37,7 @@ class Subscribe < ActiveRecord::Base
     if subscribe = Subscribe.where(options).first
       subscribe.update_attributes(status: status)
     else
-      Subscribe.create(options.merge(status: status), without_protection: true)
+      Subscribe.create options.merge(status: status)
     end
   end
 

app/policies/comment_policy.rb

@@ -11,4 +11,11 @@ class CommentPolicy < ApplicationPolicy
   end
   alias_method :destroy?, :update?
 
+  # Public: Get list of parameters that the user is allowed to alter.
+  #
+  # Returns Array
+  def permitted_attributes
+    %i(body data)
+  end
+
 end

app/policies/subscribe_policy.rb

@@ -11,4 +11,12 @@ class SubscribePolicy < ApplicationPolicy
     return true if record.subscribeable.is_a?(Grit::Commit)
     record.subscribeable.subscribes.exists?(user_id: user.id)
   end
+
+  # Public: Get list of parameters that the user is allowed to alter.
+  #
+  # Returns Array
+  def permitted_attributes
+    %i(status user_id)
+  end
+
 end