set activerecord whitelist_attributes to true

app/models/event.rb

@@ -1,6 +1,9 @@
 class Event < ActiveRecord::Base
   include PushEvent
 
+  attr_accessible :project, :action, :data, :author_id, :project_id,
+                  :target_id, :target_type
+
   default_scope where("author_id IS NOT NULL")
 
   Created   = 1

app/models/issue.rb

@@ -2,6 +2,9 @@ class Issue < ActiveRecord::Base
   include IssueCommonality
   include Votes
 
+  attr_accessible :title, :assignee_id, :closed, :position, :description,
+                  :milestone_id, :label_list, :author_id_of_changes
+
   acts_as_taggable_on :labels
 
   belongs_to :milestone

app/models/key.rb

@@ -4,7 +4,7 @@ class Key < ActiveRecord::Base
   belongs_to :user
   belongs_to :project
 
-  attr_protected :user_id
+  attr_accessible :key, :title
 
   validates :title,
             presence: true,

app/models/merge_request.rb

@@ -4,6 +4,9 @@ class MergeRequest < ActiveRecord::Base
   include IssueCommonality
   include Votes
 
+  attr_accessible :title, :assignee_id, :closed, :target_branch, :source_branch,
+                  :author_id_of_changes
+
   BROKEN_DIFF = "--broken-diff"
 
   UNCHECKED = 1
@@ -48,7 +51,8 @@ class MergeRequest < ActiveRecord::Base
   end
 
   def mark_as_unchecked
-    self.update_attributes(state: UNCHECKED)
+    self.state = UNCHECKED
+    self.save
   end
 
   def can_be_merged?

app/models/milestone.rb

@@ -13,6 +13,8 @@
 #
 
 class Milestone < ActiveRecord::Base
+  attr_accessible :title, :description, :due_date, :closed
+
   belongs_to :project
   has_many :issues
 

app/models/note.rb

@@ -2,6 +2,9 @@ require 'carrierwave/orm/activerecord'
 require 'file_size_validator'
 
 class Note < ActiveRecord::Base
+  attr_accessible :note, :noteable, :noteable_id, :noteable_type, :project_id,
+                  :attachment, :line_code
+
   belongs_to :project
   belongs_to :noteable, polymorphic: true
   belongs_to :author,
@@ -16,7 +19,6 @@ class Note < ActiveRecord::Base
            to: :author,
            prefix: true
 
-  attr_protected :author, :author_id
   attr_accessor :notify
   attr_accessor :notify_author
 

app/models/project.rb

@@ -6,6 +6,9 @@ class Project < ActiveRecord::Base
   include Authority
   include Team
 
+  attr_accessible :name, :path, :description, :code, :default_branch, :issues_enabled,
+                  :wall_enabled, :merge_requests_enabled, :wiki_enabled
+
   #
   # Relations
   #
@@ -25,11 +28,6 @@ class Project < ActiveRecord::Base
 
   attr_accessor :error_code
 
-  #
-  # Protected attributes
-  #
-  attr_protected :private_flag, :owner_id
-
   #
   # Scopes
   #

app/models/protected_branch.rb

@@ -1,6 +1,8 @@
 class ProtectedBranch < ActiveRecord::Base
   include GitHost
 
+  attr_accessible :name
+
   belongs_to :project
   validates_presence_of :project_id
   validates_presence_of :name

app/models/snippet.rb

@@ -1,6 +1,8 @@
 class Snippet < ActiveRecord::Base
   include Linguist::BlobHelper
 
+  attr_accessible :title, :content, :file_name, :expires_at
+
   belongs_to :project
   belongs_to :author, class_name: "User"
   has_many :notes, as: :noteable, dependent: :destroy
@@ -9,7 +11,6 @@ class Snippet < ActiveRecord::Base
            :email,
            to: :author,
            prefix: true
-  attr_protected :author, :author_id, :project, :project_id
 
   validates_presence_of :project_id
   validates_presence_of :author_id
@@ -46,11 +47,11 @@ class Snippet < ActiveRecord::Base
     0
   end
 
-  def name 
+  def name
     file_name
   end
 
-  def mode 
+  def mode
     nil
   end
 

app/models/users_project.rb

@@ -6,11 +6,11 @@ class UsersProject < ActiveRecord::Base
   DEVELOPER = 30
   MASTER    = 40
 
+  attr_accessible :user, :user_id, :project_access
+
   belongs_to :user
   belongs_to :project
 
-  attr_protected :project_id, :project
-
   after_save :update_repository
   after_destroy :update_repository
 

app/models/web_hook.rb

@@ -1,6 +1,8 @@
 class WebHook < ActiveRecord::Base
   include HTTParty
 
+  attr_accessible :url
+
   # HTTParty timeout
   default_timeout 10
 
@@ -18,11 +20,11 @@ class WebHook < ActiveRecord::Base
       post_url = url.gsub(parsed_url.userinfo+"@", "")
       WebHook.post(post_url,
                    body: data.to_json,
-                   headers: { "Content-Type" => "application/json" }, 
+                   headers: { "Content-Type" => "application/json" },
                    basic_auth: {username: parsed_url.user, password: parsed_url.password})
     end
   end
-  
+
 end
 # == Schema Information
 #

app/models/wiki.rb

@@ -1,4 +1,6 @@
 class Wiki < ActiveRecord::Base
+  attr_accessible :title, :content, :slug
+
   belongs_to :project
   belongs_to :user
   has_many :notes, as: :noteable, dependent: :destroy

app/roles/issue_commonality.rb

@@ -3,8 +3,6 @@ module IssueCommonality
   extend ActiveSupport::Concern
 
   included do
-    attr_protected :author, :author_id, :project, :project_id
-
     belongs_to :project
     belongs_to :author, class_name: "User"
     belongs_to :assignee, class_name: "User"