Raise error on unpermitted params.

Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs

app/views/bans/edit.html.erb

@@ -1,7 +1,14 @@
 <div id="c-bans">
   <div id="a-edit">
     <h1>Edit Ban</h1>
-    <%= render "form", :ban => @ban %>
+
+    <%= simple_form_for(@ban) do |f| %>
+      <%= error_messages_for("ban") %>
+
+      <%= f.input :duration, :hint => "in days" %>
+      <%= f.input :reason %>
+      <%= f.button :submit, :value => "Ban" %>
+    <% end %>
   </div>
 </div>
 

app/views/bans/index.html.erb

@@ -20,11 +20,11 @@
           <tr id="ban-<%= ban.id %>" data-expired="<%= ban.expired? %>">
             <td>
               <%= link_to_user(ban.user) %>
-              <%= link_to "»", bans_path(search: params[:search].merge(user_name: ban.user.name)) %>
+              <%= link_to "»", bans_path(search: search_params.merge(user_name: ban.user.name)) %>
             </td>
             <td>
               <%= link_to_user(ban.banner) %>
-              <%= link_to "»", bans_path(search: params[:search].merge(banner_name: ban.banner.name)) %>
+              <%= link_to "»", bans_path(search: search_params.merge(banner_name: ban.banner.name)) %>
             </td>
             <td><%= time_ago_in_words_tagged(ban.created_at) %></td>
             <td><%= humanized_duration(ban.created_at, ban.expires_at) %></td>

app/views/comments/_index_by_comment.html.erb

@@ -18,4 +18,4 @@
 
 <%= numbered_paginator(@comments) %>
 
-<% content_for(:html_header, auto_discovery_link_tag(:atom, comments_url(:atom, search: params[:search]), title: "Comments")) %>
+<% content_for(:html_header, auto_discovery_link_tag(:atom, comments_url(format: "atom"), title: "Comments")) %>

app/views/forum_posts/partials/edit/_form.html.erb

@@ -1,7 +1,6 @@
 <%= error_messages_for("forum_post") %>
 
 <%= simple_form_for(forum_post) do |f| %>
-  <%= f.input :topic_id, :as => :hidden %>
   <%= dtext_field "forum_post", "body", :value => forum_post.body, :classes => "autocomplete-mentions", :input_id => "forum_post_body_for_#{forum_post.id}", :preview_id => "dtext-preview-for-#{forum_post.id}" %>
 
   <%= f.button :submit, "Submit" %>

app/views/forum_topics/_form.html.erb

@@ -10,10 +10,6 @@
     </div>
 
     <%= f.simple_fields_for :original_post do |pf| %>
-      <% if !forum_topic.new_record? %>
-        <%= hidden_field_tag "forum_topic[original_post_attributes][topic_id]", forum_topic.id %>
-      <% end %>
-
       <%= dtext_field "forum_post", "body", :classes => "autocomplete-mentions", :input_name => "forum_topic[original_post_attributes][body]", :value => forum_topic.original_post.body, :input_id => "forum_post_body_for_#{forum_topic.original_post.id}", :preview_id => "dtext-preview-for-#{forum_topic.original_post.id}" %>
     <% end %>
 

app/views/forum_topics/_listing.html.erb

@@ -20,7 +20,7 @@
               <span class="new">NEW</span>
             <% end %>
 
-            <%= link_to topic.title, forum_topic_path(topic) %>
+            <%= link_to topic.title, forum_topic_path(topic), class: "forum-post-link" %>
 
             <% if topic.response_count > Danbooru.config.posts_per_page %>
               <%= link_to "page #{topic.last_page}", forum_topic_path(topic, :page => topic.last_page), :class => "last-page" %>

app/views/moderator/post/disapprovals/create.js.erb

@@ -9,4 +9,4 @@ $("#c-posts #approve").hide();
 $("#c-posts #disapprove").hide();
 
 $("#pending-approval-notice, .notice-flagged, .notice-appealed").hide();
-$("#c-moderator-post-queues #post-<%= @post.id %>").hide();
+$("#c-moderator-post-queues #post-<%= @post_disapproval.post.id %>").hide();

app/views/moderator/post/queues/_post.html.erb

@@ -6,13 +6,7 @@
   <section>
     <ul>
       <li>
-        <h2>
-          <%= link_to "Approve", moderator_post_approval_path(:post_id => post.id), :remote => true, :method => :post, :class => "approve-link" %> 
-          | <%= link_to "Breaks Rules", moderator_post_disapproval_path(:post_id => post.id, :reason => "breaks_rules"), :remote => true, :method => :post, :class => "disapprove-link" %>
-          | <%= link_to "Poor Quality", moderator_post_disapproval_path(:post_id => post.id, :reason => "poor_quality"), :remote => true, :method => :post, :class => "disapprove-link" %>
-          | <%= link_to "No Interest", moderator_post_disapproval_path(:post_id => post.id, :reason => "disinterest"), :remote => true, :method => :post, :class => "disapprove-link" %>
-          | <%= link_to "Detailed Rejection", "#", "data-post-id" => post.id, :class => "detailed-rejection-link" %>
-        </h2>
+        <h2><%= render "moderator/post/queues/quick_mod", post: post %></h2>
       </li>
       <li><strong>Rating</strong>: <%= post.pretty_rating %></li>
       <li><strong>Score</strong>: <%= post.score %></li>

app/views/moderator/post/queues/_quick_mod.html.erb

@@ -0,0 +1,7 @@
+<div class="quick-mod">
+  <%= link_to_if post.is_approvable?, "Approve", moderator_post_approval_path(post_id: post.id), id: "quick-mod-approve", method: :post, remote: true, class: "btn" %> |
+  <%= link_to "Breaks Rules", moderator_post_disapproval_path(post_disapproval: { post_id: post.id, reason: "breaks_rules" }), method: :post, remote: true, class: "btn" %> |
+  <%= link_to "Poor Quality", moderator_post_disapproval_path(post_disapproval: { post_id: post.id, reason: "poor_quality" }), method: :post, remote: true, class: "btn" %> |
+  <%= link_to "No Interest",  moderator_post_disapproval_path(post_disapproval: { post_id: post.id, reason: "disinterest" }), method: :post, remote: true, class: "btn" %> |
+  <%= link_to "Detailed Rejection", "#", "data-post-id" => post.id, class: "detailed-rejection-link btn" %>
+</div>

app/views/note_versions/_standard_listing.html.erb

@@ -16,7 +16,7 @@
     </thead>
     <tbody>
       <% @note_versions.each do |note_version| %>
-        <tr>
+        <tr id="note-version-<%= note_version.id%>">
           <td></td>
           <td>
             <%= link_to note_version.post_id, post_path(note_version.post_id) %>

app/views/pool_versions/_standard_listing.html.erb

@@ -15,7 +15,7 @@
     </thead>
     <tbody>
       <% @pool_versions.each do |pool_version| %>
-        <tr>
+        <tr id="pool-version-<%= pool_version.id %>">
           <td><%= link_to pool_version.pretty_name, pool_path(pool_version.pool_id), :class => "pool-category-#{pool_version.pool.category}" %></td>
           <td><%= link_to pool_version.post_ids.size, pool_versions_path(:search => {:pool_id => pool_version.pool_id}) %></td>
           <td class="col-expand"><%= pool_version_diff(pool_version) %></td>

app/views/post_disapprovals/_detailed_rejection_dialog.html.erb

@@ -1,17 +1,9 @@
 <div id="detailed-rejection-dialog" title="Detailed Rejection" style="display: none;">
-  <%= form_tag(moderator_post_disapproval_path, :class => "simple_form", :id => "detailed-rejection-form") do %>
-    <%= hidden_field_tag "post_id", "x" %>
+  <p>You can supply a short message to the uploader explaining why you rejected this upload.</p>
 
-    <p>You can supply a short message to the uploader explaining why you rejected this upload.</p>
-
-    <div class="input">
-      <label>Reason</label>
-      <%= select_tag "reason", options_for_select([["Breaks Rules", "breaks_rules"], ["Poor Quality", "poor_quality"], ["No Interest", "disinterest"]]) %>
-    </div>
-
-    <div class="input">
-      <label>Message</label>
-      <%= text_field_tag "message" %>
-    </div>
+  <%= simple_form_for(PostDisapproval.new, url: moderator_post_disapproval_path, remote: true, id: "detailed-rejection-form") do |f| %>
+    <%= f.hidden_field :post_id, value: "x" %>
+    <%= f.input :reason, collection: [["Breaks Rules", "breaks_rules"], ["Poor Quality", "poor_quality"], ["No interest", "disinterest"]] %>
+    <%= f.input :message, as: :string %>
   <% end %>
 </div>

app/views/post_votes/create.js.erb

@@ -3,7 +3,6 @@
 <% else %>
   Danbooru.notice("Vote saved");
   $("#score-for-post-<%= @post.id %>").html(<%= @post.score %>);
+  $("#vote-links-for-post-<%= @post.id %>").hide();
+  $("#unvote-link-for-post-<%= @post.id %>").show();
 <% end %>
-
-$("#vote-links-for-post-<%= @post.id %>").hide();
-$("#unvote-link-for-post-<%= @post.id %>").show();

app/views/posts/partials/show/_notices.html.erb

@@ -41,16 +41,7 @@
     <%= render "post_disapprovals/counts", :disapprovals => post.disapprovals, :post => post %>
 
     <% if CurrentUser.can_approve_posts? && !post.disapproved_by?(CurrentUser.user) %>
-      <div class="quick-mod">
-        <% unless post.is_status_locked? %>
-          <%= link_to "Approve", moderator_post_approval_path(:post_id => post.id), :id => "quick-mod-approve", :method => :post, :remote => true, :class => "btn" %> |
-        <% end %>
-        <%= link_to "Breaks Rules", moderator_post_disapproval_path(:post_id => post.id, :reason => "breaks_rules"), :method => :post, :remote => true, :class => "btn" %> |
-        <%= link_to "Poor Quality", moderator_post_disapproval_path(:post_id => post.id, :reason => "poor_quality"), :method => :post, :remote => true, :class => "btn" %> |
-        <%= link_to "No Interest", moderator_post_disapproval_path(:post_id => post.id, :reason => "disinterest"), :method => :post, :remote => true, :class => "btn" %> |
-        <%= link_to "Detailed Rejection", "#", "data-post-id" => post.id, :class => "detailed-rejection-link btn" %>
-
-      </div>
+      <%= render "moderator/post/queues/quick_mod", post: post %>
     <% end %>
   </div>
 <% end %>

app/views/posts/partials/show/_options.html.erb

@@ -42,7 +42,7 @@
         <% if post.is_flagged? || post.is_pending? %>
           <li><%= link_to "Approve", moderator_post_approval_path(:post_id => post.id), :remote => true, :method => :post, :id => "approve", :data => { :confirm => "Are you sure you want to approve this post?" } %></li>
         <% else %>
-          <li><%= link_to "Hide from queue", moderator_post_disapproval_path(:post_id => post.id), :remote => true, :method => :post, :id => "disapprove" %></li>
+          <li><%= link_to "Hide from queue", moderator_post_disapproval_path(post_disapproval: { post_id: post.id, reason: "disinterest" }), remote: true, method: :post, id: "disapprove" %></li>
         <% end %>
 
         <% if post.is_banned? %>

app/views/posts/show.html.erb

@@ -144,10 +144,6 @@
   <div id="add-to-favgroup-dialog" title="Add to favorite group" style="display: none;">
     <%= render "favorite_groups/add_to_favgroup_dialog", :post => @post %>
   </div>
-
-  <div id="saved-searches-nav">
-    <%= render "saved_searches/interface" %>
-  </div>
 </div>
 
 <%= post_view_count_js %>

app/views/saved_searches/_interface.html.erb

@@ -1,14 +1,10 @@
 <% if SavedSearch.enabled? %>
   <div id="save-search-dialog" title="Save Search" style="display: none;">
-    <%= form_tag(saved_searches_path, :class => "simple_form", :remote => true) do %>
-      <%= hidden_field_tag "saved_search_tags", params[:tags] %>
 
-      <div class="input">
-        <label for="saved_search_labels">Label</label>
-        <%= text_field_tag "saved_search_labels", "" %>
-      </div>
-
-      <p><label><%= check_box_tag "saved_search_disable_labels" %> Disable labels</label></p>
+    <%= simple_form_for(SavedSearch.new, remote: true) do |f| %>
+      <%= f.input :query, as: :string, input_html: { value: params[:tags] } %>
+      <%= f.input :label_string, label: "Labels", hint: "A list of tags to help categorize this search. Space delimited." %>
+      <%= f.input :disable_labels, label: "Don't show this dialog again", as: :boolean %>
     <% end %>
   </div>
-<% end %>
+<% end %>

app/views/saved_searches/edit.html.erb

@@ -5,7 +5,7 @@
     <%= error_messages_for :saved_search %>
 
     <%= simple_form_for(@saved_search) do |f| %>
-      <%= f.input :query %>
+      <%= f.input :query, :as => :string %>
       <%= f.input :label_string, :label => "Labels", :hint => "A list of tags to help categorize this search. Space delimited." %>
       <%= f.button :submit, :value => "Submit", :data => { :disable_with => "Submitting..." } %>
     <% end %>

app/views/uploads/batch.html.erb

@@ -12,8 +12,10 @@
           <%= link_to new_upload_path(url: url, ref: params[:url]), target: "_blank" do %>
             <% if ImageProxy.needs_proxy?(url) %>
               <%= image_tag(image_proxy_uploads_path(url: url)) %>
-            <% else %>
+            <% elsif url.is_a?(String) %>
               <%= image_tag url %>
+            <% else %>
+              Direct Link
             <% end %>
           <% end %>
         </div>

app/views/user_name_change_requests/new.html.erb

@@ -8,15 +8,9 @@
 
     <%= error_messages_for "change_request" %>
 
-    <%= form_tag(user_name_change_requests_path, :class => "simple_form") do %>
-      <div class="input">
-        <label for="desired_name">Desired Name</label>
-        <%= text_field_tag "desired_name" %>
-      </div>
-
-      <div class="input">
-        <%= submit_tag "Submit", :data => { :disable_with => "Submitting..." } %>
-      </div>
+    <%= simple_form_for(@change_request) do |f| %>
+      <%= f.input :desired_name %>
+      <%= f.submit "Submit", data: { disable_with: "Submitting..." } %>
     <% end %>
   </div>
 </div>