fixes #1396, fix tests

app/models/note.rb

@@ -7,6 +7,7 @@ class Note < ActiveRecord::Base
   before_validation :initialize_updater
   before_validation :blank_body
   validates_presence_of :post_id, :creator_id, :updater_id, :x, :y, :width, :height
+  validate :coordinates_in_range, :message => "must be inside the image"
   has_many :versions, :class_name => "NoteVersion", :order => "note_versions.id ASC"
   after_save :update_post
   after_save :create_version
@@ -95,6 +96,13 @@ class Note < ActiveRecord::Base
     self.updater_ip_addr = CurrentUser.ip_addr
   end
 
+  def coordinates_in_range
+    if x < 0 || y < 0 || (x > post.image_width) || (y > post.image_height)
+      self.errors.add(:coordinates, "must be inside the image")
+      return false
+    end
+  end
+
   def post_must_not_be_note_locked
     if is_locked?
       errors.add :post, "is note locked"