Initially comment out attr_accessible

app/models/bank_account.rb

@@ -1,18 +1,19 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class BankAccount < ApplicationRecord
 
-	attr_accessible \
-	:name, # str (readable bank name identifier, eg. "Wells Fargo *1234")
-	:confirmation_token, # str (randomly generated private token for email confirmation)
-	:account_number, # str (last digits only)
-	:bank_name, # str
-	:pending_verification, # bool (whether this bank account is still awaiting email confirmation)
-	:status, # str
-	:email, # str (contact email associated with the user who created this bank account)
-	:deleted, # bool (soft delete flag)
-	:stripe_bank_account_token, # str
-	:stripe_bank_account_id, # str
-	:nonprofit_id, :nonprofit
+	#TODO
+	# attr_accessible \
+	# :name, # str (readable bank name identifier, eg. "Wells Fargo *1234")
+	# :confirmation_token, # str (randomly generated private token for email confirmation)
+	# :account_number, # str (last digits only)
+	# :bank_name, # str
+	# :pending_verification, # bool (whether this bank account is still awaiting email confirmation)
+	# :status, # str
+	# :email, # str (contact email associated with the user who created this bank account)
+	# :deleted, # bool (soft delete flag)
+	# :stripe_bank_account_token, # str
+	# :stripe_bank_account_id, # str
+	# :nonprofit_id, :nonprofit
 
 	#validates :stripe_bank_account_token, presence: true, uniqueness: true
 	# validates :stripe_bank_account_id, presence: true, uniqueness: true

app/models/billing_plan.rb

@@ -3,13 +3,14 @@ class BillingPlan < ApplicationRecord
 	Names = ['Starter', 'Fundraising', 'Supporter Management']
 	DefaultAmounts = [0, 9900, 29900] # in pennies
 
-	attr_accessible \
-		:name, #str: readable name
-		:tier, #int: 0-4 (0: Free, 1: Fundraising, 2: Supporter Management)
-		:amount, #int (cents)
-		:stripe_plan_id, #str (matches plan ID in Stripe) Not needed if it's not a paying subscription
-		:interval, #str ('monthly', 'annual')
-		:percentage_fee # 0.038
+	#TODO
+	# attr_accessible \
+	# 	:name, #str: readable name
+	# 	:tier, #int: 0-4 (0: Free, 1: Fundraising, 2: Supporter Management)
+	# 	:amount, #int (cents)
+	# 	:stripe_plan_id, #str (matches plan ID in Stripe) Not needed if it's not a paying subscription
+	# 	:interval, #str ('monthly', 'annual')
+	# 	:percentage_fee # 0.038
 
 	has_many :billing_subscriptions
 

app/models/billing_subscription.rb

@@ -1,11 +1,12 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class BillingSubscription < ApplicationRecord
 
-	attr_accessible \
-		:nonprofit_id, :nonprofit,
-		:billing_plan_id, :billing_plan,
-		:stripe_subscription_id,
-		:status # trialing, active, past_due, canceled, or unpaid
+	#TODO
+	# attr_accessible \
+	# 	:nonprofit_id, :nonprofit,
+	# 	:billing_plan_id, :billing_plan,
+	# 	:stripe_subscription_id,
+	# 	:status # trialing, active, past_due, canceled, or unpaid
 
 	attr_accessor :stripe_plan_id, :manual
 	belongs_to :nonprofit

app/models/campaign.rb

@@ -1,41 +1,42 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Campaign < ApplicationRecord
 
-	attr_accessible \
-		:name,
-		:tagline,
-		:slug, # str: url name
-		:total_supporters,
-		:goal_amount,
-		:nonprofit_id,
-		:profile_id,
-		:main_image,
-		:remove_main_image, # for carrierwave
-		:background_image,
-		:remove_background_image, #bool carrierwave
-    :banner_image,
-    :remove_banner_image,
-		:published,
-		:video_url, #str
-		:vimeo_video_id,
-		:youtube_video_id,
-		:summary,
-		:recurring_fund, # bool: whether this is a recurring campaign
-		:body,
-		:goal_amount_dollars, #accessor: translated into goal_amount (cents)
-		:show_total_raised, # bool
-		:show_total_count, # bool
-		:hide_activity_feed, # bool
-    :end_datetime,
-		:deleted, #bool (soft delete)
-		:hide_goal, # bool
-		:hide_thermometer, #bool
-		:hide_title, # bool
-    :receipt_message, # text
-    :hide_custom_amounts, # boolean
-    :parent_campaign_id,
-    :reason_for_supporting,
-    :default_reason_for_supporting
+	#TODO
+	# attr_accessible \
+	# 	:name,
+	# 	:tagline,
+	# 	:slug, # str: url name
+	# 	:total_supporters,
+	# 	:goal_amount,
+	# 	:nonprofit_id,
+	# 	:profile_id,
+	# 	:main_image,
+	# 	:remove_main_image, # for carrierwave
+	# 	:background_image,
+	# 	:remove_background_image, #bool carrierwave
+    # :banner_image,
+    # :remove_banner_image,
+	# 	:published,
+	# 	:video_url, #str
+	# 	:vimeo_video_id,
+	# 	:youtube_video_id,
+	# 	:summary,
+	# 	:recurring_fund, # bool: whether this is a recurring campaign
+	# 	:body,
+	# 	:goal_amount_dollars, #accessor: translated into goal_amount (cents)
+	# 	:show_total_raised, # bool
+	# 	:show_total_count, # bool
+	# 	:hide_activity_feed, # bool
+    # :end_datetime,
+	# 	:deleted, #bool (soft delete)
+	# 	:hide_goal, # bool
+	# 	:hide_thermometer, #bool
+	# 	:hide_title, # bool
+    # :receipt_message, # text
+    # :hide_custom_amounts, # boolean
+    # :parent_campaign_id,
+    # :reason_for_supporting,
+    # :default_reason_for_supporting
 
   validate  :end_datetime_cannot_be_in_past, :on => :create
 	validates :profile, :presence => true

app/models/campaign_gift.rb

@@ -1,11 +1,12 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class CampaignGift < ApplicationRecord
 
-	attr_accessible \
-		:donation_id,
-		:donation,
-		:campaign_gift_option,
-		:campaign_gift_option_id
+	#TODO
+	# attr_accessible \
+	# 	:donation_id,
+	# 	:donation,
+	# 	:campaign_gift_option,
+	# 	:campaign_gift_option_id
 
 	belongs_to :donation
 	belongs_to :campaign_gift_option

app/models/campaign_gift_option.rb

@@ -1,17 +1,18 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class CampaignGiftOption < ApplicationRecord
 
-	attr_accessible \
-		:amount_one_time, #int (cents)
-		:amount_recurring, #int (cents)
-		:amount_dollars, #str, gets converted to amount
-		:description, # text
-		:name, # str
-		:campaign, #assocation
-		:quantity, #int (optional)
-		:to_ship, #boolean 
-		:order, #int (optional) 
-		:hide_contributions #boolean (optional) 
+	#TODO
+	# attr_accessible \
+	# 	:amount_one_time, #int (cents)
+	# 	:amount_recurring, #int (cents)
+	# 	:amount_dollars, #str, gets converted to amount
+	# 	:description, # text
+	# 	:name, # str
+	# 	:campaign, #assocation
+	# 	:quantity, #int (optional)
+	# 	:to_ship, #boolean
+	# 	:order, #int (optional)
+	# 	:hide_contributions #boolean (optional)
 
 	belongs_to :campaign
 	has_many :campaign_gifts

app/models/card.rb

@@ -1,17 +1,18 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Card < ApplicationRecord
 
-	attr_accessible \
-		:cardholders_name, # str (name associated with this card)
-		:email, # str (cache the email associated with this card)
-		:name, # str (readable card name, eg. Visa *1234)
-		:failure_message, # accessor for temporarily storing the stripe decline message
-		:status, # str
-		:stripe_card_token, # str
-		:stripe_card_id, # str
-		:stripe_customer_id, # str
-		:holder, :holder_id, :holder_type, # polymorphic cardholder association
-		:inactive # a card is inactive. This is currently only meaningful for nonprofit cards
+	#TODO
+	# attr_accessible \
+	# 	:cardholders_name, # str (name associated with this card)
+	# 	:email, # str (cache the email associated with this card)
+	# 	:name, # str (readable card name, eg. Visa *1234)
+	# 	:failure_message, # accessor for temporarily storing the stripe decline message
+	# 	:status, # str
+	# 	:stripe_card_token, # str
+	# 	:stripe_card_id, # str
+	# 	:stripe_customer_id, # str
+	# 	:holder, :holder_id, :holder_type, # polymorphic cardholder association
+	# 	:inactive # a card is inactive. This is currently only meaningful for nonprofit cards
 
 
 	attr_accessor :failure_message

app/models/charge.rb

@@ -3,11 +3,12 @@
 
 class Charge < ApplicationRecord
 
-	attr_accessible \
-		:amount,
-		:fee,
-		:stripe_charge_id,
-		:status
+	#TODO
+	# attr_accessible \
+	# 	:amount,
+	# 	:fee,
+	# 	:stripe_charge_id,
+	# 	:status
 
 
 	has_one :campaign, through: :donation

app/models/comment.rb

@@ -1,10 +1,11 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Comment < ApplicationRecord
 
-	attr_accessible \
-		:host_id, :host_type, #parent: Event, Campaign, nil
-		:profile_id,
-		:body
+	#TODO
+	# attr_accessible \
+	# 	:host_id, :host_type, #parent: Event, Campaign, nil
+	# 	:profile_id,
+	# 	:body
 
 	validates :profile, :presence => true
 	validates :body, :presence => true, :length => {:maximum => 200}

app/models/custom_field_join.rb

@@ -1,10 +1,11 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class CustomFieldJoin < ApplicationRecord
 
-	attr_accessible \
-		:supporter, :supporter_id,
-		:custom_field_master, :custom_field_master_id,
-		:value
+	#TODO
+	# attr_accessible \
+	# 	:supporter, :supporter_id,
+	# 	:custom_field_master, :custom_field_master_id,
+	# 	:value
 
 	validates :custom_field_master, presence: true
 

app/models/dispute.rb

@@ -3,14 +3,15 @@ class Dispute < ApplicationRecord
 
   Reasons = [:unrecognized, :duplicate, :fraudulent, :subscription_canceled, :product_unacceptable, :product_not_received, :unrecognized, :credit_not_processed, :goods_services_returned_or_refused, :goods_services_cancelled, :incorrect_account_details, :insufficient_funds, :bank_cannot_process, :debit_not_authorized, :general]
 
-  Statuses = [:needs_response, :under_review, :won, :lost, :lost_and_paid]
 
-  attr_accessible \
-    :gross_amount, # int
-    :charge_id, :charge,
-    :payment_id, :payment,
-    :status,
-    :reason
+  Statuses = [:needs_response, :under_review, :won, :lost, :lost_and_paid]
+  #TODO
+  # attr_accessible \
+  #   :gross_amount, # int
+  #   :charge_id, :charge,
+  #   :payment_id, :payment,
+  #   :status,
+  #   :reason
 
   belongs_to :charge
   belongs_to :payment

app/models/donation.rb

@@ -1,25 +1,26 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Donation < ApplicationRecord
 
-	attr_accessible \
-		:date, # datetime (when this donation was made)
-		:amount, # int (in cents)
-		:recurring, # bool
-		:anonymous, # bool
-		:email, # str (cached email of the donor)
-		:designation, # text
-		:dedication, # text
-		:comment, # text
-		:origin_url, # text
-		:nonprofit_id, :nonprofit,
-		:card_id, :card, # Card with which any charges were made
-		:supporter_id, :supporter,
-		:profile_id, :profile,
-		:campaign_id, :campaign,
-		:payment_id, :payment,
-		:event_id, :event,
-		:direct_debit_detail_id, :direct_debit_detail,
-    :payment_provider
+	#TODO
+	# attr_accessible \
+	# 	:date, # datetime (when this donation was made)
+	# 	:amount, # int (in cents)
+	# 	:recurring, # bool
+	# 	:anonymous, # bool
+	# 	:email, # str (cached email of the donor)
+	# 	:designation, # text
+	# 	:dedication, # text
+	# 	:comment, # text
+	# 	:origin_url, # text
+	# 	:nonprofit_id, :nonprofit,
+	# 	:card_id, :card, # Card with which any charges were made
+	# 	:supporter_id, :supporter,
+	# 	:profile_id, :profile,
+	# 	:campaign_id, :campaign,
+	# 	:payment_id, :payment,
+	# 	:event_id, :event,
+	# 	:direct_debit_detail_id, :direct_debit_detail,
+    # :payment_provider
 
 	validates :amount, presence: true, numericality: { only_integer: true }
 	validates :supporter, presence: true

app/models/email_draft.rb

@@ -1,12 +1,12 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class EmailDraft < ApplicationRecord
-
-	attr_accessible \
-		:nonprofit, :nonprofit_id,
-		:name,
-		:deleted,
-		:value,
-		:created_at
+	#TODO
+	# attr_accessible \
+	# 	:nonprofit, :nonprofit_id,
+	# 	:name,
+	# 	:deleted,
+	# 	:value,
+	# 	:created_at
 
 	belongs_to :nonprofit
 

app/models/email_setting.rb

@@ -1,14 +1,15 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class EmailSetting < ApplicationRecord
 
-  attr_accessible \
-    :user_id, :user,
-    :nonprofit_id, :nonprofit,
-    :notify_payments,
-    :notify_campaigns,
-    :notify_events,
-    :notify_payouts,
-    :notify_recurring_donations
+  #TODO
+  # attr_accessible \
+  #   :user_id, :user,
+  #   :nonprofit_id, :nonprofit,
+  #   :notify_payments,
+  #   :notify_campaigns,
+  #   :notify_events,
+  #   :notify_payouts,
+  #   :notify_recurring_donations
 
   belongs_to :nonprofit
   belongs_to :user

app/models/event.rb

@@ -1,38 +1,39 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Event < ApplicationRecord
 
-	attr_accessible \
-		:deleted, #bool for soft-delete
-		:name, # str
-		:tagline, # str
-		:summary, # text
-		:body, # text (html)
-    :end_datetime,
-    :start_datetime,
-		:latitude, # float
-		:longitude, # float
-		:location, # str
-		:city, # str
-		:state_code, # str
-		:address, # str
-		:zip_code, # str
-		:main_image, # str
-		:remove_main_image, # for carrierwave
-		:background_image, # str
-		:remove_background_image, # bool carrierwave
-		:published, # bool
-		:slug, # str
-		:directions, # text
-		:venue_name, # str
-		:profile_id, # creator
-		:ticket_levels_attributes,
-		:show_total_raised, # bool
-		:show_total_count, # bool
-		:hide_activity_feed, # bool
-		:nonprofit_id, # host
-		:hide_title,  # bool
-    :organizer_email, # string
-    :receipt_message # text
+	#TODO
+	# attr_accessible \
+	# 	:deleted, #bool for soft-delete
+	# 	:name, # str
+	# 	:tagline, # str
+	# 	:summary, # text
+	# 	:body, # text (html)
+    # :end_datetime,
+    # :start_datetime,
+	# 	:latitude, # float
+	# 	:longitude, # float
+	# 	:location, # str
+	# 	:city, # str
+	# 	:state_code, # str
+	# 	:address, # str
+	# 	:zip_code, # str
+	# 	:main_image, # str
+	# 	:remove_main_image, # for carrierwave
+	# 	:background_image, # str
+	# 	:remove_background_image, # bool carrierwave
+	# 	:published, # bool
+	# 	:slug, # str
+	# 	:directions, # text
+	# 	:venue_name, # str
+	# 	:profile_id, # creator
+	# 	:ticket_levels_attributes,
+	# 	:show_total_raised, # bool
+	# 	:show_total_count, # bool
+	# 	:hide_activity_feed, # bool
+	# 	:nonprofit_id, # host
+	# 	:hide_title,  # bool
+    # :organizer_email, # string
+    # :receipt_message # text
 
 	validates :name, :presence => true
   validates :end_datetime, :presence => true

app/models/event_discount.rb

@@ -1,10 +1,11 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class EventDiscount < ApplicationRecord
-  attr_accessible \
-    :code,
-    :event_id,
-    :name,
-    :percent
+  #TODO
+  # attr_accessible \
+  #   :code,
+  #   :event_id,
+  #   :name,
+  #   :percent
 
   belongs_to :event
   has_many :tickets

app/models/full_contact_info.rb

@@ -1,19 +1,20 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactInfo < ApplicationRecord
-	attr_accessible \
-		:email,
-		:full_name,
-		:gender,
-		:city,
-		:county,
-		:state_code,
-		:country,
-		:continent,
-		:age,
-		:age_range,
-    :location_general,
-    :supporter_id, :supporter,
-    :websites
+	#TODO
+	# attr_accessible \
+	# 	:email,
+	# 	:full_name,
+	# 	:gender,
+	# 	:city,
+	# 	:county,
+	# 	:state_code,
+	# 	:country,
+	# 	:continent,
+	# 	:age,
+	# 	:age_range,
+    # :location_general,
+    # :supporter_id, :supporter,
+    # :websites
 
 	has_many :full_contact_photos
 	has_many :full_contact_social_profiles

app/models/full_contact_org.rb

@@ -1,15 +1,16 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactOrg < ApplicationRecord
 
-	attr_accessible \
-    :name,
-    :is_primary,
-    :name,
-    :start_date,
-    :end_date,
-    :title,
-    :current,
-    :full_contact_info_id, :full_contact_info
+  #TODO
+	# attr_accessible \
+  #   :name,
+  #   :is_primary,
+  #   :name,
+  #   :start_date,
+  #   :end_date,
+  #   :title,
+  #   :current,
+  #   :full_contact_info_id, :full_contact_info
 
   belongs_to :full_contact_info
 

app/models/full_contact_photo.rb

@@ -1,11 +1,12 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactPhoto < ApplicationRecord
-	attr_accessible \
-		:full_contact_info,
-		:full_contact_info_id,
-		:type_id, # i.e. twitter, linkedin, facebook
-		:is_primary, #bool
-		:url #string
+	#TODO
+	# attr_accessible \
+	# 	:full_contact_info,
+	# 	:full_contact_info_id,
+	# 	:type_id, # i.e. twitter, linkedin, facebook
+	# 	:is_primary, #bool
+	# 	:url #string
 
 	belongs_to :full_contact_info
 

app/models/full_contact_social_profile.rb

@@ -1,13 +1,14 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactSocialProfile < ApplicationRecord
-	attr_accessible \
-		:full_contact_info,
-		:full_contact_info_id,
-		:type_id, # i.e. twitter, linkedin, facebook
-		:username, #string
-		:uid, # string
-		:bio, #string
-		:url #string
+	#TODO
+	# attr_accessible \
+	# 	:full_contact_info,
+	# 	:full_contact_info_id,
+	# 	:type_id, # i.e. twitter, linkedin, facebook
+	# 	:username, #string
+	# 	:uid, # string
+	# 	:bio, #string
+	# 	:url #string
 
 	belongs_to :full_contact_info
 

app/models/full_contact_topic.rb

@@ -1,10 +1,11 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class FullContactTopic < ApplicationRecord
 
-	attr_accessible \
-    :provider,
-    :value,
-    :full_contact_info_id, :full_contact_info
+  #TODO
+	# attr_accessible \
+  #   :provider,
+  #   :value,
+  #   :full_contact_info_id, :full_contact_info
 
   belongs_to :full_contact_info
 

app/models/import.rb

@@ -1,13 +1,14 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Import < ApplicationRecord
 
-	attr_accessible \
-		:user_id, :user,
-		:email, # email of the user who ma
-		:nonprofit_id, :nonprofit,
-		:row_count,
-		:imported_count,
-		:date
+	#TODO
+	# attr_accessible \
+	# 	:user_id, :user,
+	# 	:email, # email of the user who ma
+	# 	:nonprofit_id, :nonprofit,
+	# 	:row_count,
+	# 	:imported_count,
+	# 	:date
 
 	has_many :supporters
 	belongs_to :nonprofit

app/models/miscellaneous_np_info.rb

@@ -1,9 +1,10 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class MiscellaneousNpInfo < ApplicationRecord
 
-  attr_accessible \
-  :donate_again_url,
-  :change_amount_message
+  #TODO
+  # attr_accessible \
+  # :donate_again_url,
+  # :change_amount_message
 
   belongs_to :nonprofit
 end

app/models/nonprofit.rb

@@ -3,54 +3,55 @@ class Nonprofit < ApplicationRecord
 
   Categories = ["Public Benefit", "Human Services", "Education", "Civic Duty", "Human Rights", "Animals", "Environment", "Health", "Arts, Culture, Humanities", "International", "Children", "Religion", "LGBTQ", "Women's Rights", "Disaster Relief", "Veterans"]
 
-  attr_accessible \
-    :name, # str
-    :stripe_account_id, # str
-    :summary, # text: paragraph-sized organization summary
-    :tagline, # str
-    :email, # str: public organization contact email
-    :phone, # str: public org contact phone
-    :main_image, # str: url of featured image - first image in profile carousel
-    :second_image, # str: url of 2nd image in carousel
-    :third_image, # str: url of 3rd image in carousel
-    :background_image,  # str: url of large profile background
-    :remove_background_image, #bool carrierwave
-    :logo, # str: small logo image url for searching
-    :zip_code, # int
-    :website, # str: their own website url
-    :categories, # text [str]: see the constant Categories
-    :achievements, # text [str]: highlights about this org
-    :full_description, # text
-    :state_code, # str: two-letter state code (eg. CA)
-    :statement, # str: bank statement for donations towards the nonprofit
-    :city, # str
-    :slug, # str
-    :city_slug, #str
-    :state_code_slug, #str
-    :ein, # str: employee identification number
-    :published, # boolean; whether to display this profile
-    :vetted, # bool: Whether a super admin (one of CommitChange's employees) have approved this org
-    :verification_status, # str (either 'pending', 'unverified', 'escalated', 'verified' -- whether the org has submitted the identity verification form and it has been approved)
-    :latitude, # float: geocoder gem
-    :longitude, # float: geocoder gem
-    :timezone, # str
-    :address, # text
-    :thank_you_note, # text
-    :referrer, # str
-    :no_anon, # bool: whether to allow anonymous donations
-    :roles_attributes,
-    :brand_font, #string (lowercase key eg. 'helvetica')
-    :brand_color, #string (hex color value)
-    :hide_activity_feed, # bool
-    :tracking_script,
-    :facebook, #string (url)
-    :twitter, #string (url)
-    :youtube, #string (url)
-    :instagram, #string (url)
-    :blog, #string (url)
-    :card_failure_message_top, # text
-    :card_failure_message_bottom, # text
-    :autocomplete_supporter_address # boolean
+  #TODO
+  # attr_accessible \
+  #   :name, # str
+  #   :stripe_account_id, # str
+  #   :summary, # text: paragraph-sized organization summary
+  #   :tagline, # str
+  #   :email, # str: public organization contact email
+  #   :phone, # str: public org contact phone
+  #   :main_image, # str: url of featured image - first image in profile carousel
+  #   :second_image, # str: url of 2nd image in carousel
+  #   :third_image, # str: url of 3rd image in carousel
+  #   :background_image,  # str: url of large profile background
+  #   :remove_background_image, #bool carrierwave
+  #   :logo, # str: small logo image url for searching
+  #   :zip_code, # int
+  #   :website, # str: their own website url
+  #   :categories, # text [str]: see the constant Categories
+  #   :achievements, # text [str]: highlights about this org
+  #   :full_description, # text
+  #   :state_code, # str: two-letter state code (eg. CA)
+  #   :statement, # str: bank statement for donations towards the nonprofit
+  #   :city, # str
+  #   :slug, # str
+  #   :city_slug, #str
+  #   :state_code_slug, #str
+  #   :ein, # str: employee identification number
+  #   :published, # boolean; whether to display this profile
+  #   :vetted, # bool: Whether a super admin (one of CommitChange's employees) have approved this org
+  #   :verification_status, # str (either 'pending', 'unverified', 'escalated', 'verified' -- whether the org has submitted the identity verification form and it has been approved)
+  #   :latitude, # float: geocoder gem
+  #   :longitude, # float: geocoder gem
+  #   :timezone, # str
+  #   :address, # text
+  #   :thank_you_note, # text
+  #   :referrer, # str
+  #   :no_anon, # bool: whether to allow anonymous donations
+  #   :roles_attributes,
+  #   :brand_font, #string (lowercase key eg. 'helvetica')
+  #   :brand_color, #string (hex color value)
+  #   :hide_activity_feed, # bool
+  #   :tracking_script,
+  #   :facebook, #string (url)
+  #   :twitter, #string (url)
+  #   :youtube, #string (url)
+  #   :instagram, #string (url)
+  #   :blog, #string (url)
+  #   :card_failure_message_top, # text
+  #   :card_failure_message_bottom, # text
+  #   :autocomplete_supporter_address # boolean
 
   has_many :payouts
   has_many :charges

app/models/nonprofit_account.rb

@@ -1,9 +1,10 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class NonprofitAccount < ApplicationRecord
 
-	attr_accessible \
-		:stripe_account_id, #str
-		:nonprofit, :nonprofit_id #int
+	#TODO
+	# attr_accessible \
+	# 	:stripe_account_id, #str
+	# 	:nonprofit, :nonprofit_id #int
 
 	belongs_to :nonprofit
 

app/models/payment.rb

@@ -5,13 +5,14 @@
 
 class Payment < ApplicationRecord
 
-  attr_accessible \
-    :towards,
-		:gross_amount,
-		:refund_total,
-		:fee_total,
-		:kind,
-		:date
+#TODO
+#   attr_accessible \
+#     :towards,
+# 		:gross_amount,
+# 		:refund_total,
+# 		:fee_total,
+# 		:kind,
+# 		:date
 
 	belongs_to :supporter
 	belongs_to :nonprofit

app/models/payment_payout.rb

@@ -13,11 +13,12 @@
 
 class PaymentPayout < ApplicationRecord
 
-	attr_accessible \
-		:payment_id, :payment,
-		:charge_id, :charge, # deprecated
-		:payout_id, :payout,
-		:total_fees # int (cents)
+	#TODO
+	# attr_accessible \
+	# 	:payment_id, :payment,
+	# 	:charge_id, :charge, # deprecated
+	# 	:payout_id, :payout,
+	# 	:total_fees # int (cents)
 
 	belongs_to :charge # deprecated
 	belongs_to :payment

app/models/payout.rb

@@ -6,20 +6,21 @@
 
 class Payout < ApplicationRecord
 
-	attr_accessible \
-		:scheduled, # bool (whether this was made automatically at the beginning of the month)
-		:count, # int (number of donations for this payout)
-		:ach_fee, # int (in cents, the total fee for the payout itself)
-		:gross_amount, # int (in cents, total amount before fees)
-		:fee_total, # int (in cents, total amount of fees)
-		:net_amount, # int (in cents, total amount after fees for this payout)
-		:email, # str (cache of user email who issued this)
-		:user_ip, # str (ip address of the user who made this payout)
-		:status, # str ('pending', 'paid', 'canceled', or 'failed')
-		:failure_message, # str
-		:bank_name, # str: cache of the nonprofit's bank name
-		:stripe_transfer_id, # str
-		:nonprofit_id, :nonprofit
+	#TODO
+	# attr_accessible \
+	# 	:scheduled, # bool (whether this was made automatically at the beginning of the month)
+	# 	:count, # int (number of donations for this payout)
+	# 	:ach_fee, # int (in cents, the total fee for the payout itself)
+	# 	:gross_amount, # int (in cents, total amount before fees)
+	# 	:fee_total, # int (in cents, total amount of fees)
+	# 	:net_amount, # int (in cents, total amount after fees for this payout)
+	# 	:email, # str (cache of user email who issued this)
+	# 	:user_ip, # str (ip address of the user who made this payout)
+	# 	:status, # str ('pending', 'paid', 'canceled', or 'failed')
+	# 	:failure_message, # str
+	# 	:bank_name, # str: cache of the nonprofit's bank name
+	# 	:stripe_transfer_id, # str
+	# 	:nonprofit_id, :nonprofit
 
 	belongs_to :nonprofit
 	has_one    :bank_account, through: :nonprofit

app/models/profile.rb

@@ -1,23 +1,24 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Profile < ApplicationRecord
 
-	attr_accessible \
-		:registered, # bool
-		:mini_bio,
-		:first_name, # str
-		:last_name, # str
-		:name,
-		:phone, # str
-		:address, # str
-		:email, # str
-		:city, # str
-		:state_code, # str (eg. CA)
-		:zip_code, # str
-		:privacy_settings, # text [str]: XXX deprecated
-		:picture, # str: either their social network pic or a stored pic on S3
-		:anonymous, # bool: negates all privacy_settings
-		:city_state,
-		:user_id
+	#TODO
+	# attr_accessible \
+	# 	:registered, # bool
+	# 	:mini_bio,
+	# 	:first_name, # str
+	# 	:last_name, # str
+	# 	:name,
+	# 	:phone, # str
+	# 	:address, # str
+	# 	:email, # str
+	# 	:city, # str
+	# 	:state_code, # str (eg. CA)
+	# 	:zip_code, # str
+	# 	:privacy_settings, # text [str]: XXX deprecated
+	# 	:picture, # str: either their social network pic or a stored pic on S3
+	# 	:anonymous, # bool: negates all privacy_settings
+	# 	:city_state,
+	# 	:user_id
 
 	validates :email, format: {with: Email::Regex}, allow_blank: true
 

app/models/recurring_donation.rb

@@ -1,21 +1,22 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class RecurringDonation < ApplicationRecord
 
-  attr_accessible \
-    :amount, # int (cents)
-    :active, # bool (whether this recurring donation should still be paid)
-    :paydate, # int (fixed date of the month for monthly recurring donations)
-    :interval, # int (interval of time, ie the '3' in '3 months')
-    :time_unit, # str ('month', 'day', 'week', or 'year')
-    :start_date, # date (when to start this recurring donation)
-    :end_date, # date (when to deactivate this recurring donation)
-    :n_failures, # int (how many times the charge has failed)
-    :edit_token, # str / uuid to validate the editing page, linked from their email client
-    :cancelled_by, # str email of user/supporter who made the cancellation
-    :cancelled_at, # datetime of user/supporter who made the cancellation
-    :donation_id, :donation,
-    :nonprofit_id, :nonprofit,
-    :supporter_id #used because things are messed up in the datamodel
+  #TODO:
+  # attr_accessible \
+  #   :amount, # int (cents)
+  #   :active, # bool (whether this recurring donation should still be paid)
+  #   :paydate, # int (fixed date of the month for monthly recurring donations)
+  #   :interval, # int (interval of time, ie the '3' in '3 months')
+  #   :time_unit, # str ('month', 'day', 'week', or 'year')
+  #   :start_date, # date (when to start this recurring donation)
+  #   :end_date, # date (when to deactivate this recurring donation)
+  #   :n_failures, # int (how many times the charge has failed)
+  #   :edit_token, # str / uuid to validate the editing page, linked from their email client
+  #   :cancelled_by, # str email of user/supporter who made the cancellation
+  #   :cancelled_at, # datetime of user/supporter who made the cancellation
+  #   :donation_id, :donation,
+  #   :nonprofit_id, :nonprofit,
+  #   :supporter_id #used because things are messed up in the datamodel
 
   scope :active,   -> {where(active: true)}
   scope :inactive, -> {where(active: [false,nil])}

app/models/refund.rb

@@ -3,16 +3,17 @@ class Refund < ApplicationRecord
 
 	Reasons = [:duplicate, :fraudulent, :requested_by_customer]
 
-	attr_accessible \
-		:amount, # int
-		:comment, # text
-		:reason, # str ('duplicate', 'fraudulent', or 'requested_by_customer')
-		:stripe_refund_id,
-		:disbursed, # boolean (whether this refund has been counted in a payout)
-		:failure_message, # str (accessor for storing the Stripe error message)
-		:user_id, :user, # user who made this refund
-		:payment_id, :payment, # negative payment that records this refund
-		:charge_id, :charge
+	# TODO:
+	# attr_accessible \
+	# 	:amount, # int
+	# 	:comment, # text
+	# 	:reason, # str ('duplicate', 'fraudulent', or 'requested_by_customer')
+	# 	:stripe_refund_id,
+	# 	:disbursed, # boolean (whether this refund has been counted in a payout)
+	# 	:failure_message, # str (accessor for storing the Stripe error message)
+	# 	:user_id, :user, # user who made this refund
+	# 	:payment_id, :payment, # negative payment that records this refund
+	# 	:charge_id, :charge
 
 	attr_accessor :failure_message
 

app/models/role.rb

@@ -10,10 +10,11 @@ class Role < ApplicationRecord
 		:event_editor          # //
 	]
 
-	attr_accessible \
-		:name,
-		:user_id, :user,
-		:host, :host_id, :host_type # nil, "Nonprofit", "Campaign", "Event"
+	# TODO:
+	# attr_accessible \
+	# 	:name,
+	# 	:user_id, :user,
+	# 	:host, :host_id, :host_type # nil, "Nonprofit", "Campaign", "Event"
 
 	belongs_to :user
 	belongs_to :host, polymorphic: true

app/models/supporter.rb

@@ -1,33 +1,34 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class Supporter < ApplicationRecord
 
-  attr_accessible \
-    :search_vectors,
-    :profile_id, :profile,
-    :nonprofit_id, :nonprofit,
-    :full_contact_info, :full_contact_info_id,
-    :import_id, :import,
-    :name,
-    :first_name,
-    :last_name,
-    :email,
-    :address,
-    :city,
-    :state_code,
-    :country,
-    :phone,
-    :organization,
-    :latitude,
-    :locale,
-    :longitude,
-    :zip_code,
-    :total_raised,
-    :notes,
-    :fields,
-    :anonymous,
-    :deleted, # bool (flag for soft delete)
-    :email_unsubscribe_uuid, #string
-    :is_unsubscribed_from_emails #bool
+  #TODO
+  # attr_accessible \
+  #   :search_vectors,
+  #   :profile_id, :profile,
+  #   :nonprofit_id, :nonprofit,
+  #   :full_contact_info, :full_contact_info_id,
+  #   :import_id, :import,
+  #   :name,
+  #   :first_name,
+  #   :last_name,
+  #   :email,
+  #   :address,
+  #   :city,
+  #   :state_code,
+  #   :country,
+  #   :phone,
+  #   :organization,
+  #   :latitude,
+  #   :locale,
+  #   :longitude,
+  #   :zip_code,
+  #   :total_raised,
+  #   :notes,
+  #   :fields,
+  #   :anonymous,
+  #   :deleted, # bool (flag for soft delete)
+  #   :email_unsubscribe_uuid, #string
+  #   :is_unsubscribed_from_emails #bool
 
   belongs_to :profile
   belongs_to :nonprofit

app/models/supporter_email.rb

@@ -1,14 +1,15 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class SupporterEmail < ApplicationRecord
-	attr_accessible \
-		:to,
-		:from,
-		:subject,
-		:body,
-		:recipient_count,
-		:supporter_id, :supporter,
-		:nonprofit_id,
-		:gmail_thread_id
+	# TODO
+	# attr_accessible \
+	# 	:to,
+	# 	:from,
+	# 	:subject,
+	# 	:body,
+	# 	:recipient_count,
+	# 	:supporter_id, :supporter,
+	# 	:nonprofit_id,
+	# 	:gmail_thread_id
 
 	belongs_to :supporter
 	validates_presence_of :nonprofit_id

app/models/supporter_note.rb

@@ -1,9 +1,10 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class SupporterNote < ApplicationRecord
 
-	attr_accessible \
-		:content,
-		:supporter_id, :supporter
+	#TODO
+	# attr_accessible \
+	# 	:content,
+	# 	:supporter_id, :supporter
 
 	belongs_to :supporter
 	has_many :activities, as: :attachment, dependent: :destroy

app/models/tag_join.rb

@@ -1,9 +1,10 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TagJoin < ApplicationRecord
 
-	attr_accessible \
-		:supporter, :supporter_id,
-		:tag_master, :tag_master_id
+	#TODO
+	# attr_accessible \
+	# 	:supporter, :supporter_id,
+	# 	:tag_master, :tag_master_id
 
 	validates :tag_master, presence: true
 

app/models/tag_master.rb

@@ -1,11 +1,12 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TagMaster < ApplicationRecord
 
-	attr_accessible \
-		:nonprofit, :nonprofit_id,
-		:name,
-		:deleted,
-		:created_at
+	#TODO:
+	# attr_accessible \
+	# 	:nonprofit, :nonprofit_id,
+	# 	:name,
+	# 	:deleted,
+	# 	:created_at
 
 	validates :name, presence: true
 	validate :no_dupes, on: :create

app/models/ticket_level.rb

@@ -1,17 +1,18 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class TicketLevel < ApplicationRecord
 
-  attr_accessible \
-    :amount, #integer
-    :amount_dollars, #accessor, string
-    :name, #string
-    :description, #text
-    :quantity, #integer
-    :deleted, #bool for soft delete
-    :event_id,
-    :admin_only, #bool, only admins can create tickets for this level
-    :limit, #int: for limiting the number of tickets to be sold
-    :order #int: order in which to be displayed 
+  #TODO
+  # attr_accessible \
+  #   :amount, #integer
+  #   :amount_dollars, #accessor, string
+  #   :name, #string
+  #   :description, #text
+  #   :quantity, #integer
+  #   :deleted, #bool for soft delete
+  #   :event_id,
+  #   :admin_only, #bool, only admins can create tickets for this level
+  #   :limit, #int: for limiting the number of tickets to be sold
+  #   :order #int: order in which to be displayed
 
   attr_accessor :amount_dollars
 

app/models/user.rb

@@ -1,29 +1,30 @@
 # License: AGPL-3.0-or-later WITH Web-Template-Output-Additional-Permission-3.0-or-later
 class User < ApplicationRecord
 
-	attr_accessible \
-		:email, # str: balidated with Devise
-		:password, # str: hashed with bcrypt
-    :phone, # str
-		:location,
-		:city,
-		:state_code,
-		:password_confirmation, # accessor: used on registration
-		:remember_me, # bool: don't sign user out for a while
-		:provider, # str: OAuth provider
-		:uid, # str: OAuth user ID
-		:pending_password, # bool: User registered with oauth and did not set a password
-		:name, # str: created with oauth
-		:auto_generated, # bool: flag whether a password was auto-generated for this account
-		:referer, # str: ID of the user who referred this account
-		:latitude,
-		:longitude,
-		:reset_password_token,
-		:reset_password_sent_at,
-		:picture, # str: url for fb or twitter pic
-		:current_password, # accessor: for updating pass
-		:profile_attributes,
-    :phone
+	#TODO:
+	# attr_accessible \
+	# 	:email, # str: balidated with Devise
+	# 	:password, # str: hashed with bcrypt
+    # :phone, # str
+	# 	:location,
+	# 	:city,
+	# 	:state_code,
+	# 	:password_confirmation, # accessor: used on registration
+	# 	:remember_me, # bool: don't sign user out for a while
+	# 	:provider, # str: OAuth provider
+	# 	:uid, # str: OAuth user ID
+	# 	:pending_password, # bool: User registered with oauth and did not set a password
+	# 	:name, # str: created with oauth
+	# 	:auto_generated, # bool: flag whether a password was auto-generated for this account
+	# 	:referer, # str: ID of the user who referred this account
+	# 	:latitude,
+	# 	:longitude,
+	# 	:reset_password_token,
+	# 	:reset_password_sent_at,
+	# 	:picture, # str: url for fb or twitter pic
+	# 	:current_password, # accessor: for updating pass
+	# 	:profile_attributes,
+    # :phone
 
 	geocoded_by :location