NPO-Accounting/houdini
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(event_discounts ): add strong params

Browse source
This commit is contained in:
Luis Castro 2019-08-06 16:05:24 +02:00 committed by Eric Schultz
parent 6bdd95a5e9
commit 567830b9be
2 changed files with 13 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
app/controllers/event_discounts_controller.rb
View file

@ -6,9 +6,9 @@ class EventDiscountsController < ApplicationController
before_action :authenticate_event_editor!, except: [:index] before_action :authenticate_event_editor!, except: [:index]
def create def create
params[:event_discount][:event_id] = current_event.id event_discount_params[:event_id] = current_event.id
render JsonResp.new(params[:event_discount]) do |_data| render JsonResp.new(event_discount_params) do |_data|
requires(:code, :name).as_string requires(:code, :name).as_string
requires(:event_id, :percent).as_int requires(:event_id, :percent).as_int
end.when_valid do |data| end.when_valid do |data|
@ -23,7 +23,7 @@ class EventDiscountsController < ApplicationController
def update def update
discount = Hamster.to_ruby( discount = Hamster.to_ruby(
Psql.execute( Psql.execute(
Qexpr.new.update(:event_discounts, params[:event_discount]) Qexpr.new.update(:event_discounts, event_discount_params)
.where('id=$id', id: params[:id]) .where('id=$id', id: params[:id])
.returning('*') .returning('*')
).first ).first
@ -38,4 +38,10 @@ class EventDiscountsController < ApplicationController
.where('event_discounts.id=$id', id: params['id']) .where('event_discounts.id=$id', id: params['id'])
) )
end end
private
def event_discount_params
params.required(:event_discount).permit(:code, :event_id, :name, :percent)
end
end end

2
app/models/event_discount.rb
View file

@ -2,8 +2,6 @@
# License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
class EventDiscount < ApplicationRecord class EventDiscount < ApplicationRecord
# TODO
# attr_accessible \
# :code, # :code,
# :event_id, # :event_id,
# :name, # :name,