Merge branch 'next-minor' into develop

Changelog.md

@@ -29,6 +29,9 @@ Although the chat was never enabled per default and was marked as experimental,
 
 # 0.7.13.0
 
+## Security
+* Fixes [USN-4274-1](https://usn.ubuntu.com/4274-1/), a potential Denial-of-Service vulnerability in Nokogiri. [#8108](https://github.com/diaspora/diaspora/pull/8108)
+
 ## Refactor
 * Set better example values for unicorn stdout/stderr log settings [#8058](https://github.com/diaspora/diaspora/pull/8058)
 * Replace dependency on rails-assets.org with custom gems cache at gems.diasporafoundation.org [#8087](https://github.com/diaspora/diaspora/pull/8087)

Gemfile

@@ -2,7 +2,7 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.1.7"
+gem "rails", "5.2.4.1"
 
 # Legacy Rails features, remove me!
 # responders (class level)
@@ -27,7 +27,7 @@ gem "yajl-ruby",   "1.4.1"
 
 # Authentication
 
-gem "devise", "4.6.1"
+gem "devise", "4.7.1"
 gem "devise-two-factor", "3.0.3"
 gem "devise_lastseenable", "0.0.6"
 gem "rqrcode", "0.10.1"
@@ -55,7 +55,7 @@ gem "configurate", "0.3.1"
 
 # Cross-origin resource sharing
 
-gem "rack-cors", "1.0.3", require: "rack/cors"
+gem "rack-cors", "1.1.1", require: "rack/cors"
 
 # CSS
 
@@ -82,7 +82,7 @@ gem "activerecord-import", "1.0.2"
 
 gem "carrierwave", "1.3.1"
 gem "fog-aws",     "3.5.1"
-gem "mini_magick", "4.9.3"
+gem "mini_magick", "4.10.1"
 
 # GUID generation
 gem "uuid", "2.3.9"
@@ -146,7 +146,7 @@ gem "leaflet-rails",       "1.5.1"
 
 # Parsing
 
-gem "nokogiri",          "1.10.3"
+gem "nokogiri",          "1.10.8"
 gem "open_graph_reader", "0.7.0" # also update User-Agent in features/support/webmock.rb
 gem "redcarpet",         "3.4.0"
 gem "ruby-oembed",       "0.12.0"
@@ -158,7 +158,7 @@ gem "string-direction", "1.2.1"
 
 # Security Headers
 
-gem "secure_headers", "6.1.1"
+gem "secure_headers", "6.3.0"
 
 # Services
 
@@ -201,7 +201,7 @@ gem "logging-rails", "0.6.0", require: "logging/rails"
 
 # Reading and writing zip files
 
-gem "rubyzip", "1.2.2", require: "zip"
+gem "rubyzip", "1.3.0", require: "zip"
 
 # Prevent occasions where minitest is not bundled in
 # packaged versions of ruby. See following issues/prs:

Gemfile.lock

@@ -2,25 +2,25 @@ GEM
   remote: https://rubygems.org/
   remote: https://gems.diasporafoundation.org/
   specs:
-    actioncable (5.1.7)
+    actioncable (5.2.4.1)
-      actionpack (= 5.1.7)
+      actionpack (= 5.2.4.1)
       nio4r (~> 2.0)
-      websocket-driver (~> 0.6.1)
+      websocket-driver (>= 0.6.1)
-    actionmailer (5.1.7)
+    actionmailer (5.2.4.1)
-      actionpack (= 5.1.7)
+      actionpack (= 5.2.4.1)
-      actionview (= 5.1.7)
+      actionview (= 5.2.4.1)
-      activejob (= 5.1.7)
+      activejob (= 5.2.4.1)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.1.7)
+    actionpack (5.2.4.1)
-      actionview (= 5.1.7)
+      actionview (= 5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
-      rack (~> 2.0)
+      rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.1.7)
+    actionview (5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
@@ -28,18 +28,22 @@ GEM
     active_model_serializers (0.9.7)
       activemodel (>= 3.2)
       concurrent-ruby (~> 1.0)
-    activejob (5.1.7)
+    activejob (5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
       globalid (>= 0.3.6)
-    activemodel (5.1.7)
+    activemodel (5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
-    activerecord (5.1.7)
+    activerecord (5.2.4.1)
-      activemodel (= 5.1.7)
+      activemodel (= 5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
-      arel (~> 8.0)
+      arel (>= 9.0)
     activerecord-import (1.0.2)
       activerecord (>= 3.2)
-    activesupport (5.1.7)
+    activestorage (5.2.4.1)
+      actionpack (= 5.2.4.1)
+      activerecord (= 5.2.4.1)
+      marcel (~> 0.3.1)
+    activesupport (5.2.4.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -53,7 +57,7 @@ GEM
     addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
     aes_key_wrap (1.0.1)
-    arel (8.0.0)
+    arel (9.0.0)
     asset_sync (2.7.0)
       activemodel (>= 4.1.0)
       fog-core
@@ -77,7 +81,7 @@ GEM
       sassc (>= 2.0.0)
     bootstrap-switch-rails (3.3.3)
     buftok (0.2.0)
-    builder (3.2.3)
+    builder (3.2.4)
     byebug (11.0.1)
     capybara (3.15.0)
       addressable
@@ -131,7 +135,7 @@ GEM
       compass (~> 1.0.0)
       sass-rails (< 5.1)
       sprockets (< 4.0)
-    concurrent-ruby (1.1.5)
+    concurrent-ruby (1.1.6)
     configurate (0.3.1)
     connection_pool (2.2.2)
     coveralls (0.8.23)
@@ -142,7 +146,7 @@ GEM
       tins (~> 1.6)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.4)
+    crass (1.0.6)
     cucumber (3.1.2)
       builder (>= 2.1.2)
       cucumber-core (~> 3.2.0)
@@ -169,10 +173,10 @@ GEM
     cucumber-tag_expressions (1.1.1)
     cucumber-wire (0.0.1)
     database_cleaner (1.7.0)
-    devise (4.6.1)
+    devise (4.7.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 6.0)
+      railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
     devise-two-factor (3.0.3)
@@ -206,7 +210,7 @@ GEM
     entypo-rails (3.0.0)
       railties (>= 4.1, < 6)
     equalizer (0.0.11)
-    erubi (1.8.0)
+    erubi (1.9.0)
     eslintrb (2.1.0)
       execjs
       multi_json (>= 1.3)
@@ -215,7 +219,7 @@ GEM
       tzinfo
     ethon (0.12.0)
       ffi (>= 1.3.0)
-    excon (0.64.0)
+    excon (0.72.0)
     execjs (2.7.0)
     eye (0.10.0)
       celluloid (~> 0.17.3)
@@ -325,7 +329,7 @@ GEM
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.6.0)
+    i18n (1.8.2)
       concurrent-ruby (~> 1.0)
     i18n-inflector (2.6.7)
       i18n (>= 0.4.1)
@@ -354,7 +358,7 @@ GEM
       rails (>= 4.0, < 6.0)
       sprockets (>= 3.0.0)
     json (2.2.0)
-    json-jwt (1.10.2)
+    json-jwt (1.11.0)
       activesupport (>= 4.2)
       aes_key_wrap
       bindata
@@ -381,7 +385,7 @@ GEM
       multi_json (~> 1.10)
     logging-rails (0.6.0)
       logging (>= 1.8)
-    loofah (2.2.3)
+    loofah (2.4.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lumberjack (1.0.13)
@@ -389,6 +393,8 @@ GEM
       systemu (~> 2.6.5)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
+    marcel (0.3.3)
+      mimemagic (~> 0.3.2)
     markdown-it-html5-embed (1.0.0)
     markerb (1.1.0)
     memoizable (0.4.2)
@@ -397,10 +403,11 @@ GEM
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.0331)
-    mini_magick (4.9.3)
+    mimemagic (0.3.4)
-    mini_mime (1.0.1)
+    mini_magick (4.10.1)
+    mini_mime (1.0.2)
     mini_portile2 (2.4.0)
-    minitest (5.11.3)
+    minitest (5.14.0)
     mobile-fu (1.4.0)
       rack-mobile-detect
       rails
@@ -411,8 +418,8 @@ GEM
     mysql2 (0.5.2)
     naught (1.1.0)
     nenv (0.3.0)
-    nio4r (2.3.1)
+    nio4r (2.5.2)
-    nokogiri (1.10.3)
+    nokogiri (1.10.8)
       mini_portile2 (~> 2.4.0)
     notiffany (0.1.1)
       nenv (~> 0.1)
@@ -493,8 +500,9 @@ GEM
       pry (~> 0.10)
     public_suffix (3.1.1)
     raabro (1.1.6)
-    rack (2.0.7)
+    rack (2.2.2)
-    rack-cors (1.0.3)
+    rack-cors (1.1.1)
+      rack (>= 2.0.0)
     rack-google-analytics (1.2.0)
       actionpack
       activesupport
@@ -514,17 +522,18 @@ GEM
       rack
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
-    rails (5.1.7)
+    rails (5.2.4.1)
-      actioncable (= 5.1.7)
+      actioncable (= 5.2.4.1)
-      actionmailer (= 5.1.7)
+      actionmailer (= 5.2.4.1)
-      actionpack (= 5.1.7)
+      actionpack (= 5.2.4.1)
-      actionview (= 5.1.7)
+      actionview (= 5.2.4.1)
-      activejob (= 5.1.7)
+      activejob (= 5.2.4.1)
-      activemodel (= 5.1.7)
+      activemodel (= 5.2.4.1)
-      activerecord (= 5.1.7)
+      activerecord (= 5.2.4.1)
-      activesupport (= 5.1.7)
+      activestorage (= 5.2.4.1)
+      activesupport (= 5.2.4.1)
       bundler (>= 1.3.0)
-      railties (= 5.1.7)
+      railties (= 5.2.4.1)
       sprockets-rails (>= 2.0.0)
     rails-assets-autosize (4.0.2)
     rails-assets-backbone (1.3.3)
@@ -568,23 +577,23 @@ GEM
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.0.4)
+    rails-html-sanitizer (1.3.0)
-      loofah (~> 2.2, >= 2.2.2)
+      loofah (~> 2.3)
     rails-i18n (5.1.3)
       i18n (>= 0.7, < 2)
       railties (>= 5.0, < 6)
     rails-timeago (2.17.1)
       actionpack (>= 3.1)
       activesupport (>= 3.1)
-    railties (5.1.7)
+    railties (5.2.4.1)
-      actionpack (= 5.1.7)
+      actionpack (= 5.2.4.1)
-      activesupport (= 5.1.7)
+      activesupport (= 5.2.4.1)
       method_source
       rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
+      thor (>= 0.19.0, < 2.0)
     rainbow (3.0.0)
     raindrops (0.19.0)
-    rake (12.3.2)
+    rake (12.3.3)
     rb-fsevent (0.10.3)
     rb-inotify (0.10.0)
       ffi (~> 1.0)
@@ -634,7 +643,7 @@ GEM
     ruby-oembed (0.12.0)
     ruby-progressbar (1.10.1)
     ruby_dep (1.5.0)
-    rubyzip (1.2.2)
+    rubyzip (1.3.0)
     rugged (0.28.2)
     safe_yaml (1.0.5)
     sass (3.4.25)
@@ -653,7 +662,7 @@ GEM
     scss_lint (0.55.0)
       rake (>= 0.9, < 13)
       sass (~> 3.4.20)
-    secure_headers (6.1.1)
+    secure_headers (6.3.0)
     shellany (0.0.1)
     shoulda-matchers (4.0.1)
       activesupport (>= 4.2.0)
@@ -729,7 +738,7 @@ GEM
       unf (~> 0.1.0)
     typhoeus (1.3.1)
       ethon (>= 0.9.0)
-    tzinfo (1.2.5)
+    tzinfo (1.2.6)
       thread_safe (~> 0.1)
     uglifier (4.1.20)
       execjs (>= 0.3.0, < 3)
@@ -765,7 +774,7 @@ GEM
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    websocket-driver (0.6.5)
+    websocket-driver (0.7.1)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.4)
     will_paginate (3.1.7)
@@ -795,7 +804,7 @@ DEPENDENCIES
   cucumber-api-steps (= 0.14)
   cucumber-rails (= 1.7.0)
   database_cleaner (= 1.7.0)
-  devise (= 4.6.1)
+  devise (= 4.7.1)
   devise-two-factor (= 3.0.3)
   devise_lastseenable (= 0.0.6)
   diaspora_federation-json_schema (= 0.2.6)
@@ -831,11 +840,11 @@ DEPENDENCIES
   logging-rails (= 0.6.0)
   markdown-it-html5-embed (= 1.0.0)
   markerb (= 1.1.0)
-  mini_magick (= 4.9.3)
+  mini_magick (= 4.10.1)
   minitest
   mobile-fu (= 1.4.0)
   mysql2 (= 0.5.2)
-  nokogiri (= 1.10.3)
+  nokogiri (= 1.10.8)
   omniauth (= 1.9.0)
   omniauth-tumblr (= 1.2)
   omniauth-twitter (= 1.4.0)
@@ -851,12 +860,12 @@ DEPENDENCIES
   pronto-scss (= 0.10.0)
   pry
   pry-byebug
-  rack-cors (= 1.0.3)
+  rack-cors (= 1.1.1)
   rack-google-analytics (= 1.2.0)
   rack-piwik (= 0.3.0)
   rack-rewrite (= 1.5.1)
   rack-ssl (= 1.4.1)
-  rails (= 5.1.7)
+  rails (= 5.2.4.1)
   rails-assets-autosize (= 4.0.2)!
   rails-assets-backbone (= 1.3.3)!
   rails-assets-blueimp-gallery (= 2.33.0)!
@@ -894,9 +903,9 @@ DEPENDENCIES
   rubocop (= 0.72.0)
   rubocop-rails (= 2.1.0)
   ruby-oembed (= 0.12.0)
-  rubyzip (= 1.2.2)
+  rubyzip (= 1.3.0)
   sass-rails (= 5.0.7)
-  secure_headers (= 6.1.1)
+  secure_headers (= 6.3.0)
   shoulda-matchers (= 4.0.1)
   sidekiq (= 5.2.7)
   sidekiq-cron (= 1.1.0)

app/controllers/admins_controller.rb

@@ -51,7 +51,11 @@ class AdminsController < Admin::AdminController
   end
 
   def stats
-    @popular_tags = ActsAsTaggableOn::Tagging.joins(:tag).limit(50).order('count(taggings.id) DESC').group(:tag).count
+    @popular_tags = ActsAsTaggableOn::Tagging.joins(:tag)
+                                             .limit(50)
+                                             .order(Arel.sql("count(taggings.id) DESC"))
+                                             .group(:tag)
+                                             .count
 
     case params[:range]
     when "week"
@@ -72,7 +76,10 @@ class AdminsController < Admin::AdminController
       create_hash(model, :range => range)
     end
 
-    @posts_per_day = Post.where("created_at >= ?", Date.today - 21.days).group("DATE(created_at)").order("DATE(created_at) ASC").count
+    @posts_per_day = Post.where("created_at >= ?", Time.zone.today - 21.days)
+                         .group(Arel.sql("DATE(created_at)"))
+                         .order(Arel.sql("DATE(created_at) ASC"))
+                         .count
     @most_posts_within = @posts_per_day.values.max.to_f
 
     @user_count = User.count

app/controllers/api/openid_connect/authorizations_controller.rb

@@ -104,8 +104,9 @@ module Api
       end
 
       def handle_start_point_response(endpoint)
-        _status, header, response = endpoint.call(request.env)
+        status, header, _response = endpoint.call(request.env)
-        if response.redirect?
+
+        if status.in?([301, 302, 303, 307, 308])
           redirect_to header["Location"]
         else
           save_params_and_render_consent_form(endpoint)

app/controllers/contacts_controller.rb

@@ -66,7 +66,7 @@ class ContactsController < ApplicationController
       when "receiving"
         current_user.contacts.receiving
       when "by_aspect"
-        order.unshift "contact_id IS NOT NULL DESC"
+        order.unshift Arel.sql("contact_id IS NOT NULL DESC")
         contacts_by_aspect(@aspect.id)
       else
         raise ArgumentError, "unknown type #{type}"

app/models/person.rb

@@ -164,7 +164,7 @@ class Person < ApplicationRecord
         contacts.id IS NOT NULL AS is_contact
         SQL
              )
-      .order(<<-SQL
+      .order(Arel.sql(<<-SQL
         is_author DESC,
         is_commenter DESC,
         is_liker DESC,
@@ -172,7 +172,7 @@ class Person < ApplicationRecord
         profiles.full_name,
         people.diaspora_handle
         SQL
-            )
+                     ))
   }
 
   def self.community_spotlight
@@ -187,6 +187,8 @@ class Person < ApplicationRecord
   #   end
   # will not work!  The nil profile will be overriden with an empty one.
   def initialize(params={})
+    params = {} if params.nil?
+
     profile_set = params.has_key?(:profile) || params.has_key?("profile")
     params[:profile_attributes] = params.delete(:profile) if params.has_key?(:profile) && params[:profile].is_a?(Hash)
     super
@@ -209,7 +211,7 @@ class Person < ApplicationRecord
     self.guid
   end
 
-  private_class_method def self.search_query_string(query)
+  def self.search_query_string(query)
     query = query.downcase
     like_operator = AppConfig.postgres? ? "ILIKE" : "LIKE"
 
@@ -241,7 +243,7 @@ class Person < ApplicationRecord
     query = query.where(contacts: {sharing: true, receiving: true}) if mutual
 
     query.where(closed_account: false)
-         .order(["contacts.user_id IS NULL", "profiles.last_name ASC", "profiles.first_name ASC"])
+         .order([Arel.sql("contacts.user_id IS NULL"), "profiles.last_name ASC", "profiles.first_name ASC"])
   end
 
   def name(opts = {})

app/services/aspects_membership_service.rb

@@ -29,7 +29,7 @@ class AspectsMembershipService
   end
 
   def contacts_in_aspect(aspect_id)
-    order = ["contact_id IS NOT NULL DESC", "profiles.first_name ASC", "profiles.last_name ASC",
+    order = [Arel.sql("contact_id IS NOT NULL DESC"), "profiles.first_name ASC", "profiles.last_name ASC",
              "profiles.diaspora_handle ASC"]
     @user.aspects.find(aspect_id) # to provide better error code if aspect isn't correct
     contacts = @user.contacts.arel_table

app/services/like_service.rb

@@ -22,12 +22,12 @@ class LikeService
 
   def find_for_post(post_id)
     likes = post_service.find!(post_id).likes
-    user ? likes.order("author_id = #{user.person.id} DESC") : likes
+    user ? likes.order(Arel.sql("author_id = #{user.person.id} DESC")) : likes
   end
 
   def unlike_post(post_id)
     likes = post_service.find!(post_id).likes
-    likes = likes.order("author_id = #{user.person.id} DESC")
+    likes = likes.order(Arel.sql("author_id = #{user.person.id} DESC"))
     if !likes.empty? && user.owns?(likes[0])
       user.retract(likes[0])
       true

app/services/reshare_service.rb

@@ -13,7 +13,7 @@ class ReshareService
 
   def find_for_post(post_id)
     reshares = post_service.find!(post_id).reshares
-    user ? reshares.order("author_id = #{user.person.id} DESC") : reshares
+    user ? reshares.order(Arel.sql("author_id = #{user.person.id} DESC")) : reshares
   end
 
   private

app/views/conversations/new.mobile.haml

@@ -2,7 +2,7 @@
 -#   licensed under the Affero General Public License version 3 or later.  See
 -#   the COPYRIGHT file.
 
-%script{nonce: content_security_policy_nonce(:script)}
+%script{nonce: content_security_policy_script_nonce}
   :plain
     $(document).ready(function () {
       var data = $.parseJSON( "#{escape_javascript(@contacts_json).html_safe}" ),

app/views/layouts/_head.haml

@@ -21,7 +21,7 @@
   = stylesheet_link_tag :poltergeist_disable_transition, media: "all"
 
 = jquery_include_tag
-= include_gon(camel_case: true, nonce: content_security_policy_nonce(:script))
+= include_gon(camel_case: true, nonce: content_security_policy_script_nonce)
 = yield(:javascript)
 
 = csrf_meta_tag

config/initializers/set_session_secret.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-Rails.application.config.secret_token = AppConfig.secret_token
+Rails.application.config.secret_key_base = AppConfig.secret_token

lib/diaspora/message_renderer.rb

@@ -35,11 +35,12 @@ module Diaspora
 
       def append_and_truncate
         if options[:truncate]
-          @message = message.truncate options[:truncate]-options[:append].to_s.size
+          # TODO: Remove .dup when upgrading to Rails 6.x.
+          @message = @message.truncate(options[:truncate] - options[:append].to_s.size).dup
         end
 
-        message << options[:append].to_s
+        @message << options[:append].to_s
-        message << options[:append_after_truncate].to_s
+        @message << options[:append_after_truncate].to_s
       end
 
       def escape

spec/controllers/admins_controller_spec.rb

@@ -30,7 +30,7 @@ describe AdminsController, :type => :controller do
 
       it "succeeds" do
         get :dashboard
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "warns the user about unreviewed reports" do
@@ -62,7 +62,7 @@ describe AdminsController, :type => :controller do
 
       it 'succeeds and renders user_search' do
         get :user_search
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response).to render_template(:user_search)
       end
 
@@ -139,7 +139,7 @@ describe AdminsController, :type => :controller do
 
     it "succeeds and renders stats" do
       get :stats
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(response).to render_template(:stats)
       expect(response.body).to include(
         I18n.translate(
@@ -151,7 +151,7 @@ describe AdminsController, :type => :controller do
     it "succeeds and renders stats for different ranges" do
       %w(week 2weeks month).each do |range|
         get :stats, params: {range: range}
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response).to render_template(:stats)
         expect(response.body).not_to include(
           I18n.translate(

spec/controllers/aspect_memberships_controller_spec.rb

@@ -25,7 +25,7 @@ describe AspectMembershipsController, type: :controller do
 
     it "succeeds" do
       post :create, params: {person_id: bob.person.id, aspect_id: @aspect1.id}, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "creates an aspect membership" do
@@ -75,14 +75,14 @@ describe AspectMembershipsController, type: :controller do
     it "removes contacts from an aspect" do
       membership = alice.add_contact_to_aspect(@contact, @aspect1)
       delete :destroy, params: {id: membership.id}, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
       @aspect1.reload
       expect(@aspect1.contacts.to_a).not_to include @contact
     end
 
     it "aspect membership does not exist" do
       delete :destroy, params: {id: 123}, format: :json
-      expect(response).not_to be_success
+      expect(response).not_to be_successful
       expect(response.body).to eq(I18n.t("aspect_memberships.destroy.no_membership"))
     end
   end

spec/controllers/comments_controller_spec.rb

@@ -29,7 +29,7 @@ describe CommentsController, :type => :controller do
 
       it 'responds to format mobile' do
         post :create, params: comment_hash, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -136,7 +136,7 @@ describe CommentsController, :type => :controller do
 
     it 'works for mobile' do
       get :index, params: {post_id: @message.id}, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'returns all the comments for a post' do

spec/controllers/contacts_controller_spec.rb

@@ -14,14 +14,14 @@ describe ContactsController, :type => :controller do
     context 'format mobile' do
       it "succeeds" do
         get :index, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
     context 'format html' do
       it "succeeds" do
         get :index
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "doesn't assign contacts" do
@@ -43,7 +43,7 @@ describe ContactsController, :type => :controller do
 
         it "succeeds" do
           get :index, params: {q: @person1.first_name}, format: :json
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "responds with json" do
@@ -133,7 +133,7 @@ describe ContactsController, :type => :controller do
   describe '#spotlight' do
     it 'succeeds' do
       get :spotlight
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'gets queries for users in the app config' do

spec/controllers/conversations_controller_spec.rb

@@ -20,7 +20,7 @@ describe ConversationsController, :type => :controller do
     context "desktop" do
       it "succeeds" do
         get :new, params: {modal: true}
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -76,13 +76,13 @@ describe ConversationsController, :type => :controller do
 
     it "succeeds" do
       get :index
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(assigns[:visibilities]).to match_array(@visibilities)
     end
 
     it "succeeds with json" do
       get :index, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
       json = JSON.parse(response.body)
       expect(json.first["conversation"]).to be_present
     end
@@ -94,7 +94,7 @@ describe ConversationsController, :type => :controller do
 
     it "retrieves a conversation" do
       get :index, params: {conversation_id: @conversations.first.id}
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(assigns[:visibilities]).to match_array(@visibilities)
       expect(assigns[:conversation]).to eq(@conversations.first)
     end
@@ -108,7 +108,7 @@ describe ConversationsController, :type => :controller do
     it "retrieves a conversation message with out markdown content " do
       get :index
       @conversation = @conversations.first
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(response.body).to match(/cool stuff/)
       expect(response.body).not_to match(%r{<strong>cool stuff</strong>})
     end
@@ -134,7 +134,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with the conversation id as JSON" do
           post :create, params: params, format: :js
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(JSON.parse(response.body)["id"]).to eq(Conversation.first.id)
         end
 
@@ -172,7 +172,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with the conversation id as JSON" do
           post :create, params: params, format: :js
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(JSON.parse(response.body)["id"]).to eq(Conversation.first.id)
         end
       end
@@ -195,7 +195,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("conversations.create.fail"))
         end
       end
@@ -218,7 +218,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -241,7 +241,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -272,7 +272,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -301,7 +301,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with the conversation id as JSON" do
           post :create, params: params, format: :js
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(JSON.parse(response.body)["id"]).to eq(Conversation.first.id)
         end
 
@@ -339,7 +339,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with the conversation id as JSON" do
           post :create, params: params, format: :js
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(JSON.parse(response.body)["id"]).to eq(Conversation.first.id)
         end
       end
@@ -362,7 +362,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("conversations.create.fail"))
         end
       end
@@ -385,7 +385,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -408,7 +408,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -433,7 +433,7 @@ describe ConversationsController, :type => :controller do
 
         it "responds with an error message" do
           post :create, params: params, format: :js
-          expect(response).not_to be_success
+          expect(response).not_to be_successful
           expect(response.body).to eq(I18n.t("javascripts.conversation.create.no_recipient"))
         end
       end
@@ -452,7 +452,7 @@ describe ConversationsController, :type => :controller do
 
     it "succeeds with json" do
       get :show, params: {id: conversation.id}, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(assigns[:conversation]).to eq(conversation)
       expect(response.body).to include conversation.guid
     end

spec/controllers/help_controller_spec.rb

@@ -4,7 +4,7 @@ describe HelpController, type: :controller do
   describe "#faq" do
     it "succeeds" do
       get :faq
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "fails on mobile" do

spec/controllers/home_controller_spec.rb

@@ -33,12 +33,12 @@ describe HomeController, type: :controller do
   describe "#podmin" do
     it "succeeds" do
       get :podmin
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "succeeds on mobile" do
       get :podmin, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
   end
 

spec/controllers/jasmine_fixtures/streams_spec.rb

@@ -54,7 +54,7 @@ TXT
 
       Timecop.travel(time) do
         get :multi, :format => :json
-        expect(response).to be_success
+        expect(response).to be_successful
         save_fixture(response.body, "stream_json")
       end
     end

spec/controllers/node_info_controller_spec.rb

@@ -5,7 +5,7 @@ describe NodeInfoController do
     it "responds to JSON" do
       get :jrd, format: :json
 
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "returns a JRD" do
@@ -38,7 +38,7 @@ describe NodeInfoController do
         it "responds to JSON" do
           get :document, params: {version: version}, format: :json
 
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "calls NodeInfoPresenter" do

spec/controllers/notifications_controller_spec.rb

@@ -37,7 +37,7 @@ describe NotificationsController, :type => :controller do
       end
 
       get :update, params: {id: note.id, set_unread: "true"}, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
 
       updated_note = Notification.find(note.id)
       expect(updated_note.unread).to eq(true)
@@ -64,7 +64,7 @@ describe NotificationsController, :type => :controller do
 
     it 'succeeds' do
       get :index
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(assigns[:notifications].count).to eq(1)
     end
 
@@ -73,7 +73,7 @@ describe NotificationsController, :type => :controller do
         @notification.touch
       end
       get :index, format: :json
-      expect(response).to be_success
+      expect(response).to be_successful
       response_json = JSON.parse(response.body)
       note_html = Nokogiri::HTML(response_json["notification_list"][0]["also_commented"]["note_html"])
       timeago_content = note_html.css("time")[0]["data-time-ago"]
@@ -94,7 +94,7 @@ describe NotificationsController, :type => :controller do
 
     it 'succeeds on mobile' do
       get :index, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'paginates the notifications' do
@@ -128,7 +128,7 @@ describe NotificationsController, :type => :controller do
       it 'succeeds on mobile' do
         eve.share_with(alice.person, eve.aspects.first)
         get :index, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
@@ -157,12 +157,12 @@ describe NotificationsController, :type => :controller do
 
       it "succeeds" do
         get :index
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "succeeds on mobile" do
         get :index, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
   end

spec/controllers/people_controller_spec.rb

@@ -33,7 +33,7 @@ describe PeopleController, :type => :controller do
     describe 'via json' do
       it 'succeeds' do
         get :index, params: {q: "Korth"}, format: :json
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'responds with json' do
@@ -109,23 +109,23 @@ describe PeopleController, :type => :controller do
         it "succeeds if there is exactly one match" do
           get :index, params: {q: "Korth"}
           expect(assigns[:people].length).to eq(1)
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "succeeds if there are no matches" do
           get :index, params: {q: "Korthsauce"}
           expect(assigns[:people].length).to eq(0)
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it 'succeeds if you search for the empty term' do
           get :index, params: {q: ""}
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it 'succeeds if you search for punctuation' do
           get :index, params: {q: "+"}
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "excludes people who have searchable off" do
@@ -225,7 +225,7 @@ describe PeopleController, :type => :controller do
       profile = user2.profile
       profile.update_attribute(:first_name, "</script><script> alert('xss attack');</script>")
       get :show, params: {id: user2.person.to_param}
-      expect(response).to be_success
+      expect(response).to be_successful
       expect(response.body).not_to include(profile.first_name)
     end
 
@@ -244,12 +244,12 @@ describe PeopleController, :type => :controller do
     context "when the person is the current user" do
       it "succeeds" do
         get :show, params: {id: @user.person.to_param}
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'succeeds on the mobile site' do
         get :show, params: {id: @user.person.to_param}, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "assigns the right person" do
@@ -271,7 +271,7 @@ describe PeopleController, :type => :controller do
 
       it 'succeeds on the mobile site' do
         get :show, params: {id: @person.to_param}, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'forces to sign in if the person is remote' do
@@ -316,12 +316,12 @@ describe PeopleController, :type => :controller do
 
       it "succeeds" do
         get :show, params: {id: @person.to_param}
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'succeeds on the mobile site' do
         get :show, params: {id: @person.to_param}, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'marks a corresponding notifications as read' do
@@ -351,12 +351,12 @@ describe PeopleController, :type => :controller do
 
       it "succeeds" do
         get :show, params: {id: @person.to_param}
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'succeeds on the mobile site' do
         get :show, params: {id: @person.to_param}, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "leaks no private profile info" do
@@ -406,7 +406,7 @@ describe PeopleController, :type => :controller do
         message = @user.post :status_message, :text => 'test more', :to => @aspect.id
         @user.comment!(message, cmmt)
         get :stream, params: {person_id: @user.person.to_param}, format: :json
-        expect(response).to be_success
+        expect(response).to be_successful
         expect(response.body).to include(cmmt)
       end
     end

spec/controllers/photos_controller_spec.rb

@@ -81,17 +81,17 @@ describe PhotosController, :type => :controller do
     it "succeeds without any available pictures" do
       get :index, params: {person_id: FactoryGirl.create(:person).guid}
 
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "succeeds on mobile devices without any available pictures" do
       get :index, params: {person_id: FactoryGirl.create(:person).guid}, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "succeeds on mobile devices with available pictures" do
       get :index, params: {person_id: bob.person.guid}, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "displays the logged in user's pictures" do
@@ -145,7 +145,7 @@ describe PhotosController, :type => :controller do
 
       it "succeeds on the mobile site" do
         get :index, params: {person_id: @person.to_param}, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "forces to sign in if the person is remote" do
@@ -227,7 +227,7 @@ describe PhotosController, :type => :controller do
 
     it 'should return 200 for existing stuff on mobile devices' do
       get :show, params: {person_id: alice.person.guid, id: @alices_photo.id}, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "doesn't leak private photos to the public" do

spec/controllers/posts_controller_spec.rb

@@ -19,7 +19,7 @@ describe PostsController, type: :controller do
           expect_any_instance_of(PostService).to receive(:mark_user_notifications).with(post.id)
 
           get :show, params: {id: post.id}
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "succeeds after removing a mention when closing the mentioned user's account" do
@@ -32,7 +32,7 @@ describe PostsController, type: :controller do
           user.close_account!
 
           get :show, params: {id: msg.id}
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "renders the application layout on mobile" do
@@ -45,7 +45,7 @@ describe PostsController, type: :controller do
           expect_any_instance_of(PostService).to receive(:mark_user_notifications).with(reshare_id)
 
           get :show, params: {id: reshare_id}, format: :mobile
-          expect(response).to be_success
+          expect(response).to be_successful
         end
       end
 

spec/controllers/profiles_controller_spec.rb

@@ -25,7 +25,7 @@ describe ProfilesController, :type => :controller do
   describe '#edit' do
     it 'succeeds' do
       get :edit
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'sets the profile to the current users profile' do

spec/controllers/reshares_controller_spec.rb

@@ -13,7 +13,7 @@ describe ResharesController, :type => :controller do
 
     it 'requires authentication' do
       post_request!
-      expect(response).not_to be_success
+      expect(response).not_to be_successful
     end
 
     context 'with an authenticated user' do
@@ -23,7 +23,7 @@ describe ResharesController, :type => :controller do
       end
 
       it 'succeeds' do
-        expect(response).to be_success
+        expect(response).to be_successful
         post_request!
       end
 

spec/controllers/share_visibilities_controller_spec.rb

@@ -17,7 +17,7 @@ describe ShareVisibilitiesController, :type => :controller do
 
       it 'succeeds' do
         put :update, params: {id: 42, post_id: @status.id}, format: :js
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it 'it calls toggle_hidden_shareable' do

spec/controllers/status_messages_controller_spec.rb

@@ -17,7 +17,7 @@ describe StatusMessagesController, :type => :controller do
   describe '#bookmarklet' do
     it 'succeeds' do
       get :bookmarklet
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'contains a complete html document' do
@@ -34,14 +34,14 @@ describe StatusMessagesController, :type => :controller do
         title: "Surprised Kitty",
         notes: "cute kitty"
       }
-      expect(response).to be_success
+      expect(response).to be_successful
     end
   end
 
   describe '#new' do
     it 'succeeds' do
       get :new, params: {person_id: bob.person.id}
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'should redirect on desktop version' do

spec/controllers/streams_controller_spec.rb

@@ -15,19 +15,19 @@ describe StreamsController, :type => :controller do
     describe "#public" do
       it "succeeds" do
         get :public
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 
     describe "#multi" do
       it "succeeds" do
         get :multi
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "succeeds on mobile" do
         get :multi, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       context "getting started" do
@@ -54,7 +54,7 @@ describe StreamsController, :type => :controller do
       describe "a GET to #{stream_path}" do
         it "assigns a stream of the proper class" do
           get stream_path
-          expect(response).to be_success
+          expect(response).to be_successful
           expect(assigns[:stream]).to be_a stream_class
         end
       end
@@ -65,12 +65,12 @@ describe StreamsController, :type => :controller do
     describe "#public" do
       it "succeeds" do
         get :public
-        expect(response).to be_success
+        expect(response).to be_successful
       end
 
       it "succeeds on mobile" do
         get :public, format: :mobile
-        expect(response).to be_success
+        expect(response).to be_successful
       end
     end
 

spec/controllers/tags_controller_spec.rb

@@ -105,7 +105,7 @@ describe TagsController, :type => :controller do
 
         it 'succeeds with mobile' do
           get :show, params: {name: "foo"}, format: :mobile
-          expect(response).to be_success
+          expect(response).to be_successful
         end
 
         it "returns the post with the correct age" do

spec/controllers/terms_controller_spec.rb

@@ -4,12 +4,12 @@ describe TermsController, type: :controller do
   describe "#index" do
     it "succeeds" do
       get :index
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it "succeeds on mobile" do
       get :index, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
   end
 end

spec/controllers/users_controller_spec.rb

@@ -327,12 +327,12 @@ describe UsersController, :type => :controller do
   describe 'getting_started' do
     it 'does not fail miserably' do
       get :getting_started
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     it 'does not fail miserably on mobile' do
       get :getting_started, format: :mobile
-      expect(response).to be_success
+      expect(response).to be_successful
     end
 
     context "with inviter" do