All models are now using ActiveModel::ForbiddenAttributesProtection, which shifts the responsibility for parameter whitelisting for mass-assignments from the model to the controller. attr_accessible has been disabled and removed as this functionality replaces that.
The require_parameters method in the ApplicationController has been removed in favor of strong_parameters' #require method.
It is important to note that there is still some refactoring required to get all parameters to pass through #require and #permit so that we can guarantee that parameter values are scalar. Currently strong_parameters, in most cases, is only being utilized to require parameters and to whitelist the few places that do mass-assignments.
Category now requires parameters to be permitted by strong_parameters using #require or #permit for mass-assignment. Missing required parameters now throw a ActionController::ParameterMissing execption instead of the Discourse::InvalidParameters execption.
- removes an (n+1) query for user data
- supports the preload store for the data to avoid a second request
- fix a bug where uncategorizes was reporting (0, 0, 0) for topics by week, month, year
setting all categories to be secured led to a blank screen on all pages
use stabby lambda for consistency in class
make the test a little more concise
- move the local assignments into let blocks for
reusability
- remove calls to `to_a`, which aren't needed
- use 'be_empty' instead of '[]' to be consistent
with the other matchers in the test
add a test for the `secured` scope with multiple
secured categories
Sam
Ian Christian Myers
Neil Lalonde
nirnanaaa
Robin Ward
Victor Cruz Dueñas
Josh Susser and Avdi Grimm
Lee Machin
Kuba Brecka
Régis Hanol
Sam
Gosha Arinich
Dan Neumann
Jakub Arnold