Turn on mass assignment protection

[rails.git] / app / models / user_block.rb

diff --git a/app/models/user_block.rb b/app/models/user_block.rb
index 66b2c81ff5d28eaa320ded5afe8da0ccea04b3d3..7bf8f86b5095dbf4d12697a826d3d6d3a3639203 100644 (file)
--- a/app/models/user_block.rb
+++ b/app/models/user_block.rb
@@ -2,26 +2,27 @@ class UserBlock < ActiveRecord::Base
   validate :moderator_permissions
 
   belongs_to :user, :class_name => "User", :foreign_key => :user_id
-  belongs_to :moderator, :class_name => "User", :foreign_key => :moderator_id
+  belongs_to :creator, :class_name => "User", :foreign_key => :creator_id
   belongs_to :revoker, :class_name => "User", :foreign_key => :revoker_id
   
-  PERIODS = [0, 1, 3, 6, 12, 24, 48, 96]
+  PERIODS = USER_BLOCK_PERIODS
 
   ##
   # returns true if the block is currently active (i.e: the user can't
   # use the API).
   def active?
-    needs_view or end_at > Time.now.getutc
+    needs_view or ends_at > Time.now.getutc
   end
 
   ##
   # revokes the block, allowing the user to use the API again. the argument
   # is the user object who is revoking the ban.
   def revoke!(revoker)
-    attrs = { :end_at => Time.now.getutc(),
-              :revoker_id => @user.id,
-              :needs_view => false }
-    revoker.moderator? and update_attributes(attrs)
+    update_attributes({
+      :ends_at => Time.now.getutc(),
+      :revoker_id => revoker.id,
+      :needs_view => false
+    }, :without_protection => true)
   end
 
   private
@@ -30,7 +31,7 @@ class UserBlock < ActiveRecord::Base
   # block. this should be caught and dealt with in the controller,
   # but i've also included it here just in case.
   def moderator_permissions
-    errors.add_to_base("Must be a moderator to create or update a block.") if moderator_id_changed? and !moderator.moderator?
-    errors.add_to_base("Must be a moderator to revoke a block.") unless revoker_id.nil? or revoker.moderator?
+    errors.add(:base, I18n.t('user_block.model.non_moderator_update')) if creator_id_changed? and !creator.moderator?
+    errors.add(:base, I18n.t('user_block.model.non_moderator_revoke')) unless revoker_id.nil? or revoker.moderator?
   end
 end