adding whitelist params for chunks controller

app/controllers/chunks_controller.rb

@@ -5,7 +5,7 @@ class ChunksController < ApplicationController
 
   #GET /chunk
   def show
-    chunk = resumable_chunk params[:resumableChunkNumber]
+    chunk = resumable_chunk chunk_number
 
     if File.exists?(chunk)
       post_file_and_create_thumbnail @learning_object, resumable_filename if last_chunk?
@@ -29,7 +29,7 @@ class ChunksController < ApplicationController
     end
 
     #Move the uploaded chunk to the directory
-    FileUtils.mv params[:file].tempfile, chunk
+    FileUtils.mv chunk_tmpfile, chunk
 
     #Concatenate all the partial files into the original file
     #When all chunks are uploaded
@@ -37,7 +37,7 @@ class ChunksController < ApplicationController
       #Create a target file
       File.open(resumable_filename, "a") do |target|
         #Loop trough the chunks
-        for i in 1..params[:resumableChunkNumber].to_i
+        for i in 1..chunk_number
           #Select the chunk
           chunk = File.open(resumable_chunk(i), 'r').read
 
@@ -65,20 +65,24 @@ class ChunksController < ApplicationController
     publisher.post learning_object, filename
   end
 
+  def chunk_tmpfile
+    chunks_params[:file].tempfile
+  end
+
   def last_chunk?
     chunk_number == total_chunks
   end
 
   def chunk_size
-    params[:resumableChunkSize].to_i
+    chunks_params[:resumableChunkSize].to_i
   end
 
   def total_chunks
-    params[:resumableTotalChunks].to_i
+    chunks_params[:resumableTotalChunks].to_i
   end
 
   def chunk_number
-    params[:resumableChunkNumber].to_i
+    chunks_params[:resumableChunkNumber].to_i
   end
 
   def resumable_chunk(part)
@@ -86,14 +90,19 @@ class ChunksController < ApplicationController
   end
 
   def resumable_filename
-    "#{dir}/#{params[:resumableFilename]}"
+    "#{dir}/#{chunks_params[:resumableFilename]}"
   end
 
   def dir
-    "/tmp/#{params[:resumableIdentifier]}"
+    "/tmp/#{chunks_params[:resumableIdentifier]}"
   end
 
   def set_learning_object
-    @learning_object = LearningObject.find params[:learning_object_id]
+    @learning_object = LearningObject.find chunks_params[:learning_object_id]
+  end
+
+  # Never trust parameters from the scary internet, only allow the white list through.
+  def chunks_params
+    params.permit(:file, :learning_object_id, :resumableIdentifier, :resumableFilename, :resumableChunkNumber, :resumableTotalChunks, :resumableChunkSize)
   end
 end

app/services/thumbnail_service.rb

@@ -10,9 +10,4 @@ class ThumbnailService
     end
   end
 
-  #def update_object_thumbnail(media, object_id)
-  #  lo = LearningObject.find(object_id)
-  #  lo.thumbnail = media
-  #  lo.save!
-  #end
 end
\ No newline at end of file