Raise error on unpermitted params.

Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs

app/models/wiki_page.rb

@@ -3,19 +3,15 @@ class WikiPage < ApplicationRecord
 
   before_save :normalize_title
   before_save :normalize_other_names
-  before_validation :initialize_creator, :on => :create
-  before_validation :initialize_updater
   after_save :create_version
-  belongs_to :creator, :class_name => "User"
-  belongs_to :updater, :class_name => "User"
+  belongs_to_creator
+  belongs_to_updater
   validates_uniqueness_of :title, :case_sensitive => false
   validates_presence_of :title
   validates_presence_of :body, :unless => -> { is_deleted? || other_names.present? }
   validate :validate_rename
-  validate :validate_locker_is_builder
   validate :validate_not_locked
   attr_accessor :skip_secondary_validations
-  attr_accessible :title, :body, :is_locked, :is_deleted, :other_names, :skip_secondary_validations
   has_one :tag, :foreign_key => "name", :primary_key => "title"
   has_one :artist, lambda {where(:is_active => true)}, :foreign_key => "name", :primary_key => "title"
   has_many :versions, lambda {order("wiki_page_versions.id ASC")}, :class_name => "WikiPageVersion", :dependent => :destroy
@@ -127,13 +123,6 @@ class WikiPage < ApplicationRecord
     titled(title).select("title, id").first
   end
 
-  def validate_locker_is_builder
-    if is_locked_changed? && !CurrentUser.is_builder?
-      errors.add(:is_locked, "can be modified by builders only")
-      return false
-    end
-  end
-
   def validate_not_locked
     if is_locked? && !CurrentUser.is_builder?
       errors.add(:is_locked, "and cannot be updated")
@@ -142,7 +131,7 @@ class WikiPage < ApplicationRecord
   end
 
   def validate_rename
-    return if !title_changed? || skip_secondary_validations
+    return if !will_save_change_to_title? || skip_secondary_validations
 
     tag_was = Tag.find_by_name(Tag.normalize_name(title_was))
     if tag_was.present? && tag_was.post_count > 0
@@ -179,10 +168,6 @@ class WikiPage < ApplicationRecord
     @skip_secondary_validations = (value == true || value == "1")
   end
 
-  def creator_name
-    User.id_to_name(creator_id)
-  end
-
   def category_name
     Tag.category_for(title)
   end
@@ -192,7 +177,7 @@ class WikiPage < ApplicationRecord
   end
 
   def wiki_page_changed?
-    title_changed? || body_changed? || is_locked_changed? || is_deleted_changed? || other_names_changed?
+    saved_change_to_title? || saved_change_to_body? || saved_change_to_is_locked? || saved_change_to_is_deleted? || saved_change_to_other_names?
   end
 
   def merge_version
@@ -232,20 +217,6 @@ class WikiPage < ApplicationRecord
       end
     end
   end
-  
-  def updater_name
-    User.id_to_name(updater_id)
-  end
-
-  def initialize_creator
-    self.creator_id = CurrentUser.user.id
-  end
-
-  def initialize_updater
-    if wiki_page_changed?
-      self.updater_id = CurrentUser.user.id
-    end
-  end
 
   def post_set
     @post_set ||= PostSets::WikiPage.new(title, 1, 4)