Files
danbooru/app/models/user_feedback.rb
r888888888 abce4d2551 Raise error on unpermitted params.
Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs
2018-04-06 18:09:57 -07:00

114 lines
3.1 KiB
Ruby

class UserFeedback < ApplicationRecord
self.table_name = "user_feedback"
belongs_to :user
belongs_to_creator
attribute :disable_dmail_notification, :boolean
validates_presence_of :user, :creator, :body, :category
validates_inclusion_of :category, :in => %w(positive negative neutral)
validate :creator_is_gold
validate :user_is_not_creator
after_create :create_dmail
after_update(:if => lambda {|rec| CurrentUser.id != rec.creator_id}) do |rec|
ModAction.log(%{#{CurrentUser.name} updated user feedback for "#{rec.user_name}":/users/#{rec.user_id}},:user_feedback_update)
end
after_destroy(:if => lambda {|rec| CurrentUser.id != rec.creator_id}) do |rec|
ModAction.log(%{#{CurrentUser.name} deleted user feedback for "#{rec.user_name}":/users/#{rec.user_id}},:user_feedback_delete)
end
module SearchMethods
def positive
where("category = ?", "positive")
end
def neutral
where("category = ?", "neutral")
end
def negative
where("category = ?", "negative")
end
def for_user(user_id)
where("user_id = ?", user_id)
end
def visible(viewer = CurrentUser.user)
if viewer.is_admin?
all
else
# joins(:user).merge(User.undeleted).or(where("body !~ 'Name changed from [^\s:]+ to [^\s:]+'"))
joins(:user).where.not("users.name ~ 'user_[0-9]+~*' AND user_feedback.body ~ 'Name changed from [^\s:]+ to [^\s:]+'")
end
end
def default_order
order(created_at: :desc)
end
def search(params)
q = super
if params[:user_id].present?
q = q.for_user(params[:user_id].to_i)
end
if params[:user_name].present?
q = q.where("user_id = (select _.id from users _ where lower(_.name) = ?)", params[:user_name].mb_chars.downcase.strip.tr(" ", "_"))
end
if params[:creator_id].present?
q = q.where("creator_id = ?", params[:creator_id].to_i)
end
if params[:creator_name].present?
q = q.where("creator_id = (select _.id from users _ where lower(_.name) = ?)", params[:creator_name].mb_chars.downcase.strip.tr(" ", "_"))
end
if params[:category].present?
q = q.where("category = ?", params[:category])
end
q.apply_default_order(params)
end
end
extend SearchMethods
def user_name
User.id_to_name(user_id)
end
def user_name=(name)
self.user_id = User.name_to_id(name)
end
def create_dmail
unless disable_dmail_notification
body = %{@#{creator_name} created a "#{category} record":/user_feedbacks?search[user_id]=#{user_id} for your account:\n\n#{self.body}}
Dmail.create_automated(:to_id => user_id, :title => "Your user record has been updated", :body => body)
end
end
def creator_is_gold
if !creator.is_gold?
errors[:creator] << "must be gold"
return false
else
return true
end
end
def user_is_not_creator
if user_id == creator_id
errors[:creator] << "cannot submit feedback for yourself"
return false
else
return true
end
end
def editable_by?(editor)
(editor.is_moderator? && editor != user) || creator == editor
end
end