Fix SNP comments

app/controllers/snp_comments_controller.rb

@@ -14,7 +14,7 @@ class SnpCommentsController < ApplicationController
   end
 
   def create
-    @snp_comment = SnpComment.new(params[:snp_comment])
+    @snp_comment = SnpComment.new(comment_params)
     if @snp_comment.comment_text.index(/\A(\@\#\d*\:)/) == nil
       @snp_comment.reply_to_id = -1
     else
@@ -46,4 +46,10 @@ class SnpCommentsController < ApplicationController
       render :action => "new"
     end
   end
+
+  private
+
+  def comment_params
+    params.require(:snp_comment).permit(:snp_id, :subject, :comment_text)
+  end
 end

spec/features/snp_comments_spec.rb

@@ -0,0 +1,26 @@
+RSpec.feature 'Commenting on SNPs' do
+  let(:user) { create(:user) }
+  let!(:snp) { create(:snp) }
+
+  before do
+    sign_in(user)
+  end
+
+  scenario 'a user comments on an SNP' do
+    visit "/snps/#{snp.name}"
+
+    fill_in('Subject', with: 'Hello!')
+    fill_in('Comment text', with: 'This is a great SNP!')
+    click_on('Comment')
+
+    expect(page).to have_content('Hello!')
+    expect(page).to have_content('This is a great SNP!')
+
+    expect(SnpComment.last).to have_attributes(
+      snp_id: snp.id,
+      user_id: user.id,
+      subject: 'Hello!',
+      comment_text: 'This is a great SNP!'
+    )
+  end
+end