Disable unused contribution routes that allowed unauthenticated file upload

config/routes.rb

@@ -83,14 +83,17 @@ Rails.application.routes.draw do
     resources :application_form_item_contents
    end
 
-    resources :application_forms do
+    # 投稿功能（從 seminar 複製而來）後台無法開啟，但以下入口未檢查登入，可直接上傳檔案，先關閉。
+    # 若客戶需要投稿功能，需先比照 seminar d09fa22 補上登入/擁有者檢查與副檔名黑名單，再恢復以下路由。
+    # resources :application_forms do
+    resources :application_forms, except: [:update] do
       collection do
         get ':slug_title-:uid', to: 'application_forms#show'
-        post 'con_login_proc', to: 'application_forms#con_login_proc'
-        post 'con_logout_proc', to: 'application_forms#con_logout_proc'
-        post 'add_file_proc', to: 'application_forms#add_file_proc'
-        post 'edit_file_proc', to: 'application_forms#edit_file_proc'
-        post 'del_file', to: 'application_forms#del_file'
+        # post 'con_login_proc', to: 'application_forms#con_login_proc'
+        # post 'con_logout_proc', to: 'application_forms#con_logout_proc'
+        # post 'add_file_proc', to: 'application_forms#add_file_proc'
+        # post 'edit_file_proc', to: 'application_forms#edit_file_proc'
+        # post 'del_file', to: 'application_forms#del_file'
       end
     end
     get '/xhr/application_forms/check_availability', to: 'application_forms#check_availability'