strong_params part all the rest

refs #CNVS-32574

Change-Id: If0a354295f9433fcf4dc2a776d93ae45833a44bd
Reviewed-on: https://gerrit.instructure.com/94683
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
QA-Review: James Williams  <jamesw@instructure.com>

app/controllers/polling/poll_choices_controller.rb

@@ -115,7 +115,7 @@ module Polling
     #   }
     #
     def create
-      poll_choice_params = params[:poll_choices][0]
+      poll_choice_params = get_poll_choice_params
       @poll_choice = @poll.poll_choices.new(poll_choice_params)
       @poll_choice.is_correct = false if poll_choice_params && poll_choice_params[:is_correct].blank?
 
@@ -148,7 +148,7 @@ module Polling
     #   }
     #
     def update
-      poll_choice_params = params[:poll_choices][0]
+      poll_choice_params = get_poll_choice_params
       @poll_choice = @poll.poll_choices.find(params[:id])
 
       if poll_choice_params && poll_choice_params[:is_correct].blank?
@@ -204,5 +204,9 @@ module Polling
       }).as_json
     end
 
+    def get_poll_choice_params
+      strong_params.require(:poll_choices)[0].permit(:text, :is_correct, :position)
+    end
+
   end
 end

app/controllers/polling/poll_sessions_controller.rb

@@ -136,7 +136,7 @@ module Polling
     #   }
     #
     def create
-      poll_session_params = params[:poll_sessions][0]
+      poll_session_params = get_poll_session_params
 
       if course_id = poll_session_params.delete(:course_id)
         @course = Course.find(course_id)
@@ -183,9 +183,8 @@ module Polling
     #
     def update
       @poll_session = @poll.poll_sessions.find(params[:id])
-      poll_session_params = params[:poll_sessions][0]
       if authorized_action(@poll, @current_user, :update)
-        if @poll_session.update_attributes(poll_session_params)
+        if @poll_session.update_attributes(get_poll_session_params)
           render json: serialize_jsonapi(@poll_session)
         else
           render json: @poll_session.errors, status: :bad_request
@@ -300,5 +299,8 @@ module Polling
       }).as_json
     end
 
+    def get_poll_session_params
+      strong_params.require(:poll_sessions)[0].permit(:course_id, :course_section_id, :has_public_results)
+    end
   end
 end

app/controllers/polling/polls_controller.rb

@@ -116,8 +116,7 @@ module Polling
     #   }
     #
     def create
-      poll_params = params[:polls][0]
-      @poll = @current_user.polls.new(poll_params)
+      @poll = @current_user.polls.new(get_poll_params)
       if authorized_action(@poll, @current_user, :create)
         if @poll.save
           render json: serialize_jsonapi(@poll)
@@ -145,7 +144,7 @@ module Polling
     #
     def update
       @poll = Polling::Poll.find(params[:id])
-      poll_params = params[:polls][0]
+      poll_params = get_poll_params
 
       if authorized_action(@poll, @current_user, :update)
         poll_params.delete(:is_correct) if poll_params && poll_params[:is_correct].blank?
@@ -197,5 +196,8 @@ module Polling
       }).as_json
     end
 
+    def get_poll_params
+      strong_params.require(:polls)[0].permit(:question, :description)
+    end
   end
 end

app/models/discussion_topic/materialized_view.rb

@@ -24,7 +24,7 @@ class DiscussionTopic::MaterializedView < ActiveRecord::Base
   include Rails.application.routes.url_helpers
   def use_placeholder_host?; true; end
 
-  attr_accessible :discussion_topic
+  strong_params
 
   serialize :participants_array, Array
   serialize :entry_ids_array, Array

app/models/live_assessments/assessment.rb

@@ -18,7 +18,7 @@
 
 module LiveAssessments
   class Assessment < ActiveRecord::Base
-    attr_accessible :context, :key, :title
+    strong_params
 
     belongs_to :context, polymorphic: [:course]
     has_many :submissions, class_name: 'LiveAssessments::Submission'

app/models/live_assessments/result.rb

@@ -18,7 +18,7 @@
 
 module LiveAssessments
   class Result < ActiveRecord::Base
-    attr_accessible :user, :assessor, :passed, :assessed_at
+    strong_params
 
     belongs_to :assessor, class_name: 'User'
     belongs_to :user

app/models/live_assessments/submission.rb

@@ -18,7 +18,7 @@
 
 module LiveAssessments
   class Submission < ActiveRecord::Base
-    attr_accessible :user, :assessment, :possible, :score, :assessed_at
+    strong_params
 
     belongs_to :user
     belongs_to :assessment, class_name: 'LiveAssessments::Assessment'

app/models/lti/message_handler.rb

@@ -22,7 +22,7 @@ module Lti
     BASIC_LTI_LAUNCH_REQUEST = 'basic-lti-launch-request'.freeze
     TOOL_PROXY_REREGISTRATION_REQUEST = 'ToolProxyRegistrationRequest'.freeze
 
-    attr_accessible :message_type, :placements, :launch_path, :capabilities, :parameters, :resource_handler, :links
+    strong_params
     attr_readonly :created_at
 
     belongs_to :resource_handler, class_name: "Lti::ResourceHandler", :foreign_key => :resource_handler_id

app/models/lti/product_family.rb

@@ -19,7 +19,7 @@
 module Lti
   class ProductFamily < ActiveRecord::Base
 
-    attr_accessible :vendor_code, :product_code, :vendor_name, :vendor_description, :website, :vendor_email, :root_account
+    strong_params
 
     belongs_to :root_account, class_name: 'Account'
     has_many :tool_proxies, class_name: "Lti::ToolProxy", dependent: :destroy

app/models/lti/resource_handler.rb

@@ -19,7 +19,7 @@
 module Lti
   class ResourceHandler < ActiveRecord::Base
 
-    attr_accessible :resource_type_code, :name, :description, :icon_info, :tool_proxy
+    strong_params
     attr_readonly :created_at
 
     belongs_to :tool_proxy, class_name: 'Lti::ToolProxy'

app/models/lti/resource_placement.rb

@@ -62,7 +62,7 @@ module Lti
       'Canvas.placements.assignmentConfiguration' => ASSIGNMENT_CONFIGURATION,
     }.freeze
 
-    attr_accessible :placement, :message_handler, :resource_handler
+    strong_params
 
     belongs_to :message_handler, class_name: 'Lti::MessageHandler'
     belongs_to :resource_handler, class_name: 'Lti::ResourceHandler'

app/models/lti/tool_proxy.rb

@@ -19,7 +19,7 @@
 module Lti
   class ToolProxy < ActiveRecord::Base
 
-    attr_accessible :shared_secret, :guid, :product_version, :lti_version, :product_family, :workflow_state, :raw_data, :context, :name, :description
+    strong_params
 
     has_many :bindings, class_name: 'Lti::ToolProxyBinding', dependent: :destroy
     has_many :resources, class_name: 'Lti::ResourceHandler', dependent: :destroy

app/models/lti/tool_proxy_binding.rb

@@ -18,7 +18,7 @@
 module Lti
   class ToolProxyBinding < ActiveRecord::Base
 
-    attr_accessible :context, :tool_proxy, :enabled
+    strong_params
 
     belongs_to :tool_proxy, class_name: 'Lti::ToolProxy'
 

app/models/lti/tool_setting.rb

@@ -17,7 +17,7 @@
 
 module Lti
   class ToolSetting < ActiveRecord::Base
-    attr_accessible :tool_proxy, :context, :resource_link_id, :custom
+    strong_params
 
     belongs_to :tool_proxy
     belongs_to :context, polymorphic: [:course, :account]

app/models/moderated_grading/provisional_grade.rb

@@ -1,7 +1,7 @@
 class ModeratedGrading::ProvisionalGrade < ActiveRecord::Base
   include Canvas::GradeValidations
 
-  attr_accessible :grade, :score, :final, :graded_anonymously
+  strong_params
   attr_writer :force_save
 
   belongs_to :submission, inverse_of: :provisional_grades

app/models/moderated_grading/selection.rb

@@ -7,5 +7,5 @@ class ModeratedGrading::Selection < ActiveRecord::Base
 
   validates :student_id, uniqueness: { scope: :assignment_id }
 
-  attr_accessible :student
+  strong_params
 end

app/models/polling/poll.rb

@@ -18,7 +18,7 @@
 
 module Polling
   class Poll < ActiveRecord::Base
-    attr_accessible :user, :question, :description
+    strong_params
 
     belongs_to :user
     has_many :poll_choices, -> { order(:position) }, class_name: 'Polling::PollChoice', dependent: :destroy

app/models/polling/poll_choice.rb

@@ -20,7 +20,7 @@ module Polling
   class PollChoice < ActiveRecord::Base
     self.table_name = 'polling_poll_choices'
 
-    attr_accessible :text, :poll, :is_correct, :position
+    strong_params
 
     belongs_to :poll, class_name: 'Polling::Poll'
     has_many :poll_submissions, class_name: 'Polling::PollSubmission', dependent: :destroy

app/models/polling/poll_session.rb

@@ -18,7 +18,7 @@
 
 module Polling
   class PollSession < ActiveRecord::Base
-    attr_accessible :poll, :course, :course_section, :course_id, :course_section_id, :has_public_results
+    strong_params
 
     belongs_to :course
     belongs_to :course_section

app/models/polling/poll_submission.rb

@@ -18,7 +18,7 @@
 
 module Polling
   class PollSubmission < ActiveRecord::Base
-    attr_accessible :poll, :poll_choice, :poll_session, :user
+    strong_params
 
     belongs_to :poll, class_name: 'Polling::Poll'
     belongs_to :poll_choice, class_name: 'Polling::PollChoice'

gems/plugins/simply_versioned/lib/simply_versioned/version.rb

@@ -18,7 +18,7 @@ class Version < ActiveRecord::Base #:nodoc:
   validates_presence_of :versionable_id, :versionable_type
 
   before_create :initialize_number
-
+  
   # Return an instance of the versioned ActiveRecord model with the attribute
   # values of this version.
   def model

spec/apis/lti/ims/tool_proxy_api_spec.rb

@@ -33,7 +33,6 @@ module Lti
           guid: SecureRandom.uuid,
           shared_secret: 'abc',
           product_family: product_family,
-          root_account: account,
           product_version: '1',
           workflow_state: 'disabled',
           raw_data: {'proxy' => 'value'},

spec/apis/lti/ims/tool_setting_api_spec.rb

@@ -31,7 +31,6 @@ module Lti
           guid: SecureRandom.uuid,
           shared_secret: 'abc',
           product_family: product_family,
-          root_account: account,
           product_version: '1',
           workflow_state: 'disabled',
           raw_data: {'proxy' => 'value'},

spec/models/assignment_spec.rb

@@ -115,7 +115,6 @@ describe Assignment do
       guid: SecureRandom.uuid,
       shared_secret: 'abc',
       product_family: product_family,
-      root_account: account,
       product_version: '1',
       workflow_state: 'disabled',
       raw_data: {'proxy' => 'value'},

spec/models/lti/app_collator_spec.rb

@@ -28,7 +28,7 @@ module Lti
     context 'pagination' do
       it 'paginates correctly' do
         3.times do |_|
-          tp = create_tool_proxy(account: account, name: 'aaa')
+          tp = create_tool_proxy(context: account, name: 'aaa')
           tp.bindings.create(context: account)
         end
         3.times { |_| new_valid_external_tool(account) }