Raise error on unpermitted params.

Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs

app/models/note.rb

@@ -1,20 +1,19 @@
 class Note < ApplicationRecord
   class RevertError < Exception ; end
 
-  attr_accessor :updater_id, :updater_ip_addr, :html_id
+  attribute :updater_id, :integer
+  attribute :updater_ip_addr, :inet
+  attr_accessor :html_id
   belongs_to :post
-  belongs_to :creator, :class_name => "User"
-  belongs_to :updater, :class_name => "User"
+  belongs_to_creator
+  belongs_to_updater
   has_many :versions, lambda {order("note_versions.id ASC")}, :class_name => "NoteVersion", :dependent => :destroy
-  before_validation :initialize_creator, :on => :create
-  before_validation :initialize_updater
   validates_presence_of :post_id, :creator_id, :updater_id, :x, :y, :width, :height, :body
   validate :post_must_exist
   validate :note_within_image
   after_save :update_post
   after_save :create_version
   validate :post_must_not_be_note_locked
-  attr_accessible :x, :y, :width, :height, :body, :updater_id, :updater_ip_addr, :is_active, :post_id, :post, :html_id
 
   module SearchMethods
     def active
@@ -87,15 +86,6 @@ class Note < ApplicationRecord
   extend SearchMethods
   include ApiMethods
 
-  def initialize_creator
-    self.creator_id ||= CurrentUser.id
-  end
-
-  def initialize_updater
-    self.updater_id = CurrentUser.id
-    self.updater_ip_addr = CurrentUser.ip_addr
-  end
-
   def post_must_exist
     if !Post.exists?(post_id)
       errors.add :post, "must exist"
@@ -122,10 +112,6 @@ class Note < ApplicationRecord
     Post.exists?(["id = ? AND is_note_locked = ?", post_id, true])
   end
 
-  def creator_name
-    User.id_to_name(creator_id)
-  end
-
   def rescale!(x_scale, y_scale)
     self.x *= x_scale
     self.y *= y_scale
@@ -135,7 +121,7 @@ class Note < ApplicationRecord
   end
 
   def update_post
-    if self.changed?
+    if self.saved_changes?
       if Note.where(:is_active => true, :post_id => post_id).exists?
         execute_sql("UPDATE posts SET last_noted_at = ? WHERE id = ?", updated_at, post_id)
       else
@@ -145,7 +131,7 @@ class Note < ApplicationRecord
   end
 
   def create_version
-    return unless versioned_attributes_changed?
+    return unless saved_change_to_versioned_attributes?
 
     if merge_version?
       merge_version
@@ -156,8 +142,8 @@ class Note < ApplicationRecord
     end
   end
 
-  def versioned_attributes_changed?
-    new_record? || x_changed? || y_changed? || width_changed? || height_changed? || is_active_changed? || body_changed?
+  def saved_change_to_versioned_attributes?
+    new_record? || saved_change_to_x? || saved_change_to_y? || saved_change_to_width? || saved_change_to_height? || saved_change_to_is_active? || saved_change_to_body?
   end
 
   def create_new_version
@@ -189,7 +175,7 @@ class Note < ApplicationRecord
 
   def merge_version?
     prev = versions.last
-    prev && prev.updater_id == CurrentUser.user.id && prev.updated_at > 1.hour.ago && !is_active_changed?
+    prev && prev.updater_id == CurrentUser.user.id && prev.updated_at > 1.hour.ago && !saved_change_to_is_active?
   end
 
   def revert_to(version)