Raise error on unpermitted params.

Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs

app/models/upload.rb

@@ -8,17 +8,19 @@ class Upload < ApplicationRecord
     :artist_commentary_desc, :include_artist_commentary,
     :referer_url, :downloaded_source, :replaced_post
   belongs_to :uploader, :class_name => "User"
-  belongs_to :post
-  before_validation :initialize_uploader, :on => :create
+
+  belongs_to :post, optional: true
+
+  before_validation :initialize_attributes
   validate :uploader_is_not_limited, :on => :create
   validate :file_or_source_is_present, :on => :create
   validate :rating_given
-  attr_accessible :file, :image_width, :image_height, :file_ext, :md5, 
-    :file_size, :as_pending, :source, :rating,
-    :tag_string, :status, :backtrace, :post_id, :md5_confirmation, 
-    :parent_id, :server, :artist_commentary_title,
-    :artist_commentary_desc, :include_artist_commentary,
-    :referer_url, :replaced_post
+
+  def initialize_attributes
+    self.uploader_id = CurrentUser.user.id
+    self.uploader_ip_addr = CurrentUser.ip_addr
+    self.server = Danbooru.config.server_host
+  end
 
   module ValidationMethods
     def uploader_is_not_limited
@@ -117,7 +119,7 @@ class Upload < ApplicationRecord
         self.source = source.to_s.strip
         if is_downloadable?
           self.downloaded_source, self.source, self.file = download_from_source(source, referer_url)
-        else
+        elsif self.file.respond_to?(:tempfile)
           self.file = self.file.tempfile
         end
 
@@ -245,7 +247,7 @@ class Upload < ApplicationRecord
       result = Vips::Image.gifload(file.path, page: 1) rescue $ERROR_INFO
       if result.is_a?(Vips::Image)
         true
-      elsif result.is_a?(Vips::Error) && result.message.match?(/too few frames in GIF file/)
+      elsif result.is_a?(Vips::Error) && result.message =~ /too few frames in GIF file/
         false
       else
         raise result
@@ -337,7 +339,7 @@ class Upload < ApplicationRecord
       source =~ /^https?:\/\// && file.blank?
     end
 
-    def download_from_source(source, referer_url)
+    def download_from_source(source, referer_url = nil)
       download = Downloads::File.new(source, referer_url: referer_url)
       file = download.download!
       ugoira_service.load(download.data)
@@ -369,11 +371,6 @@ class Upload < ApplicationRecord
   end
 
   module UploaderMethods
-    def initialize_uploader
-      self.uploader_id = CurrentUser.user.id
-      self.uploader_ip_addr = CurrentUser.ip_addr
-    end
-
     def uploader_name
       User.id_to_name(uploader_id)
     end