diff --git a/app/models/approve_comment.rb b/app/models/approve_comment.rb
index 49d2802..035f2dc 100644
--- a/app/models/approve_comment.rb
+++ b/app/models/approve_comment.rb
@@ -6,7 +6,11 @@ class ApproveComment < Task
   validates_presence_of :comment_attributes
 
   def comment
-    @comment ||= Comment.new(ActiveSupport::JSON.decode(self.comment_attributes)) unless self.comment_attributes.nil?
+    unless @comment || self.comment_attributes.nil?
+      @comment = Comment.new
+      @comment.assign_attributes(ActiveSupport::JSON.decode(self.comment_attributes), :without_protection => true)
+    end
+    @comment
   end
 
   def requestor_name
diff --git a/app/models/profile.rb b/app/models/profile.rb
index 35f0215..4b315c8 100644
--- a/app/models/profile.rb
+++ b/app/models/profile.rb
@@ -3,7 +3,7 @@
 # which by default is the one returned by Environment:default.
 class Profile < ActiveRecord::Base
 
-  attr_accessible :name, :identifier
+  attr_accessible :name, :identifier, :public_profile, :nickname, :custom_footer, :custom_header, :address, :zip_code, :contact_phone
 
   # use for internationalizable human type names in search facets
   # reimplement on subclasses
diff --git a/app/models/thumbnail.rb b/app/models/thumbnail.rb
index b2fddf1..6123619 100644
--- a/app/models/thumbnail.rb
+++ b/app/models/thumbnail.rb
@@ -6,4 +6,6 @@ class Thumbnail < ActiveRecord::Base
   sanitize_filename
 
   postgresql_attachment_fu
+
+  attr_accessible :uploaded_data
 end
diff --git a/test/unit/action_tracker_notification_test.rb b/test/unit/action_tracker_notification_test.rb
index 4585ebd..dd83b65 100644
--- a/test/unit/action_tracker_notification_test.rb
+++ b/test/unit/action_tracker_notification_test.rb
@@ -65,13 +65,13 @@ class ActionTrackerNotificationTest < ActiveSupport::TestCase
     at = fast_create(ActionTracker::Record)
     person = fast_create(Person)
     assert_equal [], at.action_tracker_notifications
-    at.action_tracker_notifications<< ActionTrackerNotification.new(:profile => person)
+    at.action_tracker_notifications<< build(ActionTrackerNotification, :profile => person)
     at.reload
 
     assert_equal 1, at.action_tracker_notifications.count
     last_notification = at.action_tracker_notifications.first
 
-    at.action_tracker_notifications<< ActionTrackerNotification.new(:profile => person)
+    at.action_tracker_notifications<< build(ActionTrackerNotification, :profile => person)
     at.reload
     assert_equal [last_notification], at.action_tracker_notifications
   end
diff --git a/test/unit/approve_comment_test.rb b/test/unit/approve_comment_test.rb
index d613c20..559aaf5 100644
--- a/test/unit/approve_comment_test.rb
+++ b/test/unit/approve_comment_test.rb
@@ -9,7 +9,7 @@ class ApproveCommentTest < ActiveSupport::TestCase
     @profile = create_user('test_user', :email => "someone@anyhost.com").person
     @article = fast_create(TextileArticle, :profile_id => @profile.id, :name => 'test name', :abstract => 'Lead of article', :body => 'This is my article')
     @community = create(Community, :contact_email => "someone@anyhost.com")
-    @comment = @article.comments.build(:title => 'any comment', :body => "any text", :author => create_user('someperson').person)
+    @comment = build(Comment, :article => @article, :title => 'any comment', :body => "any text", :author => create_user('someperson').person)
   end
 
   attr_reader :profile, :article, :community
diff --git a/test/unit/article_test.rb b/test/unit/article_test.rb
index b6f783b..3e372d6 100644
--- a/test/unit/article_test.rb
+++ b/test/unit/article_test.rb
@@ -1766,7 +1766,7 @@ class ArticleTest < ActiveSupport::TestCase
 
   should 'save image on create article' do
     assert_difference Article, :count do
-      p = Article.create!(:name => 'test', :image_builder => {
+      p = create(Article, :name => 'test', :image_builder => {
         :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')
       }, :profile_id => @profile.id)
       assert_equal p.image(true).filename, 'rails.png'
diff --git a/test/unit/blog_archives_block_test.rb b/test/unit/blog_archives_block_test.rb
index ef14657..61817a7 100644
--- a/test/unit/blog_archives_block_test.rb
+++ b/test/unit/blog_archives_block_test.rb
@@ -59,7 +59,7 @@ class BlogArchivesBlockTest < ActiveSupport::TestCase
   should 'order years' do
     blog = profile.blog
     for year in 2005..2009
-      post = TextileArticle.create!(:name => "post #{year}", :profile => profile, :parent => blog, :published_at => Date.new(year, 1, 1))
+      post = create(TextileArticle, :name => "post #{year}", :profile => profile, :parent => blog, :published_at => Date.new(year, 1, 1))
     end
     block = BlogArchivesBlock.new
     block.stubs(:owner).returns(profile)
@@ -69,7 +69,7 @@ class BlogArchivesBlockTest < ActiveSupport::TestCase
   should 'order months from later to former' do
     blog = profile.blog
     for month in 1..3
-      post = TextileArticle.create!(:name => "post #{month}", :profile => profile, :parent => blog, :published_at => Date.new(2009, month, 1))
+      post = create(TextileArticle, :name => "post #{month}", :profile => profile, :parent => blog, :published_at => Date.new(2009, month, 1))
     end
     block = BlogArchivesBlock.new
     block.stubs(:owner).returns(profile)
diff --git a/test/unit/blog_test.rb b/test/unit/blog_test.rb
index 56f3987..aa5f9be 100644
--- a/test/unit/blog_test.rb
+++ b/test/unit/blog_test.rb
@@ -221,7 +221,7 @@ class BlogTest < ActiveSupport::TestCase
 
   should 'set cover image' do
     profile = fast_create(Profile)
-    blog = Blog.create(:profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
+    blog = create(Blog, :profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
     blog.save!
     blog.reload
     assert_equal blog.image(true).filename, 'rails.png'
@@ -229,7 +229,7 @@ class BlogTest < ActiveSupport::TestCase
 
   should 'remove cover image' do
     profile = fast_create(Profile)
-    blog = Blog.create(:profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
+    blog = create(Blog, :profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
     blog.save!
     blog.reload
 
@@ -241,7 +241,7 @@ class BlogTest < ActiveSupport::TestCase
 
   should 'update cover image' do
     profile = fast_create(Profile)
-    blog = Blog.create(:profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
+    blog = create(Blog, :profile_id => profile.id, :name=>'testblog', :image_builder => { :uploaded_data => fixture_file_upload('/files/rails.png', 'image/png')})
     blog.save!
     blog.reload
 
diff --git a/test/unit/box_test.rb b/test/unit/box_test.rb
index fdaba42..54c6849 100644
--- a/test/unit/box_test.rb
+++ b/test/unit/box_test.rb
@@ -100,7 +100,7 @@ class BoxTest < ActiveSupport::TestCase
     end
     Noosfero::Plugin::Manager.any_instance.stubs(:enabled_plugins).returns([SomePlugin.new])
 
-    blocks = Box.new(:position => 1).acceptable_blocks
+    blocks = build(Box, :position => 1).acceptable_blocks
     assert blocks.include?('plugin-block')
   end
 
@@ -115,7 +115,7 @@ class BoxTest < ActiveSupport::TestCase
     end
     Noosfero::Plugin::Manager.any_instance.stubs(:enabled_plugins).returns([SomePlugin.new])
 
-    blocks = Box.new(:position => 2).acceptable_blocks
+    blocks = build(Box, :position => 2).acceptable_blocks
     assert blocks.include?('plugin-block')
   end
 
diff --git a/test/unit/forum_helper_test.rb b/test/unit/forum_helper_test.rb
index aa55bec..f54f015 100644
--- a/test/unit/forum_helper_test.rb
+++ b/test/unit/forum_helper_test.rb
@@ -29,16 +29,16 @@ class ForumHelperTest < ActiveSupport::TestCase
   end
 
   should 'list posts with different classes' do
-    forum.children << older_post = TextileArticle.create!(:name => 'First post', :profile => profile, :parent => forum, :published => false, :last_changed_by => profile)
+    forum.children << older_post = create(TextileArticle, :name => 'First post', :profile => profile, :parent => forum, :published => false, :last_changed_by => profile)
     one_month_later = Time.now + 1.month
     Time.stubs(:now).returns(one_month_later)
-    forum.children << newer_post = TextileArticle.create!(:name => 'Second post', :profile => profile, :parent => forum, :published => true, :last_changed_by => profile)
+    forum.children << newer_post = create(TextileArticle, :name => 'Second post', :profile => profile, :parent => forum, :published => true, :last_changed_by => profile)
     assert_match /forum-post position-1 first odd-post.*forum-post position-2 last not-published even-post/, list_forum_posts(forum.posts)
   end
 
   should 'return post update if it has no comments' do
     author = create_user('forum test author').person
-    some_post = TextileArticle.create!(:name => 'First post', :profile => profile, :parent => forum, :published => true, :last_changed_by => author)
+    some_post = create(TextileArticle, :name => 'First post', :profile => profile, :parent => forum, :published => true, :last_changed_by => author)
     assert some_post.comments.empty?
     out = last_topic_update(some_post)
     assert_match some_post.updated_at.to_s, out
@@ -46,10 +46,10 @@ class ForumHelperTest < ActiveSupport::TestCase
   end
 
   should 'return last comment date if it has comments' do
-    some_post = TextileArticle.create!(:name => 'First post', :profile => profile, :parent => forum, :published => true)
+    some_post = create(TextileArticle, :name => 'First post', :profile => profile, :parent => forum, :published => true)
     a1, a2 = create_user('a1').person, create_user('a2').person
-    some_post.comments << Comment.new(:title => 'test', :body => 'test', :author => a1, :created_at => Time.now - 1.day)
-    some_post.comments << Comment.new(:title => 'test', :body => 'test', :author => a2, :created_at => Time.now)
+    some_post.comments << build(Comment, :title => 'test', :body => 'test', :author => a1, :created_at => Time.now - 1.day)
+    some_post.comments << build(Comment, :title => 'test', :body => 'test', :author => a2, :created_at => Time.now)
     c = Comment.last
     assert_equal 2, some_post.comments.count
     out = last_topic_update(some_post)
@@ -60,8 +60,8 @@ class ForumHelperTest < ActiveSupport::TestCase
   end
 
   should "return last comment author's name from unauthenticated user" do
-    some_post = TextileArticle.create!(:name => 'First post', :profile => profile, :parent => forum, :published => true)
-    some_post.comments << Comment.new(:name => 'John', :email => 'lenon@example.com', :title => 'test', :body => 'test')
+    some_post = create(TextileArticle, :name => 'First post', :profile => profile, :parent => forum, :published => true)
+    some_post.comments << build(Comment, :name => 'John', :email => 'lenon@example.com', :title => 'test', :body => 'test')
     c = Comment.last
     out = last_topic_update(some_post)
     assert_match "#{c.created_at.to_s} by John", out
diff --git a/test/unit/production_cost_test.rb b/test/unit/production_cost_test.rb
index 715bf3f..8f88ca7 100644
--- a/test/unit/production_cost_test.rb
+++ b/test/unit/production_cost_test.rb
@@ -32,9 +32,9 @@ class ProductionCostTest < ActiveSupport::TestCase
   end
 
   should 'not have duplicated name on same environment' do
-    cost = ProductionCost.create(:name => 'Taxes', :owner => Environment.default)
+    cost = create(ProductionCost, :name => 'Taxes', :owner => Environment.default)
 
-    invalid_cost = ProductionCost.new(:name => 'Taxes', :owner => Environment.default)
+    invalid_cost = build(ProductionCost, :name => 'Taxes', :owner => Environment.default)
     invalid_cost.valid?
 
     assert invalid_cost.errors[:name.to_s].present?
@@ -42,9 +42,9 @@ class ProductionCostTest < ActiveSupport::TestCase
 
   should 'not have duplicated name on same enterprise' do
     enterprise = fast_create(Enterprise)
-    cost = ProductionCost.create(:name => 'Taxes', :owner => enterprise)
+    cost = create(ProductionCost, :name => 'Taxes', :owner => enterprise)
 
-    invalid_cost = ProductionCost.new(:name => 'Taxes', :owner => enterprise)
+    invalid_cost = build(ProductionCost, :name => 'Taxes', :owner => enterprise)
     invalid_cost.valid?
 
     assert invalid_cost.errors[:name.to_s].present?
@@ -53,8 +53,8 @@ class ProductionCostTest < ActiveSupport::TestCase
   should 'not allow same name on enterprise if already has on environment' do
     enterprise = fast_create(Enterprise)
 
-    cost1 = ProductionCost.create(:name => 'Taxes', :owner => Environment.default)
-    cost2 = ProductionCost.new(:name => 'Taxes', :owner => enterprise)
+    cost1 = create(ProductionCost, :name => 'Taxes', :owner => Environment.default)
+    cost2 = create(ProductionCost, :name => 'Taxes', :owner => enterprise)
 
     cost2.valid?
 
@@ -65,8 +65,8 @@ class ProductionCostTest < ActiveSupport::TestCase
     enterprise = fast_create(Enterprise)
     enterprise2 = fast_create(Enterprise)
 
-    cost1 = ProductionCost.create(:name => 'Taxes', :owner => enterprise)
-    cost2 = ProductionCost.new(:name => 'Taxes', :owner => enterprise2)
+    cost1 = create(ProductionCost, :name => 'Taxes', :owner => enterprise)
+    cost2 = build(ProductionCost, :name => 'Taxes', :owner => enterprise2)
 
     cost2.valid?
 
@@ -96,7 +96,7 @@ class ProductionCostTest < ActiveSupport::TestCase
 
   should 'create a production cost on an enterprise' do
     enterprise = fast_create(Enterprise)
-    enterprise.production_costs.create(:name => 'Energy')
+    create(ProductionCost, :name => 'Energy', :owner => enterprise)
     assert_equal ['Energy'], enterprise.production_costs.map(&:name)
   end
 end
diff --git a/test/unit/profile_test.rb b/test/unit/profile_test.rb
index b3af174..d6bce55 100644
--- a/test/unit/profile_test.rb
+++ b/test/unit/profile_test.rb
@@ -592,7 +592,7 @@ class ProfileTest < ActiveSupport::TestCase
     category2 = fast_create(Category, :parent_id => pcat.id)
     profile = create(Profile, :region => region, :category_ids => [category.id])
 
-    profile.update_attributes!(:category_ids => [category2.id])
+    profile.update_attribute(:category_ids, [category2.id])
 
     assert_includes profile.categories(true), region
     assert_includes profile.categories_including_virtual(true), pcat
@@ -605,7 +605,7 @@ class ProfileTest < ActiveSupport::TestCase
     category = fast_create(Category, :parent_id => pcat.id)
     profile = create(Profile, :region => region, :category_ids => [category.id])
 
-    profile.update_attributes!(:region => region2)
+    profile.update_attribute(:region, region2)
 
     assert_includes profile.categories(true), category
     assert_includes profile.categories_including_virtual(true), pcat
@@ -747,7 +747,7 @@ class ProfileTest < ActiveSupport::TestCase
   end
 
   should 'filter html from nickname' do
-    p = Profile.create!(:identifier => 'testprofile', :name => 'test profile', :environment => Environment.default)
+    p = create(Profile, :identifier => 'testprofile', :name => 'test profile', :environment => Environment.default)
     p.nickname = "<b>code</b>"
     p.save!
     assert_equal 'code', p.nickname
@@ -841,7 +841,7 @@ class ProfileTest < ActiveSupport::TestCase
   end
 
   should 'store theme' do
-    p = Profile.new(:theme => 'my-shiny-theme')
+    p = build(Profile, :theme => 'my-shiny-theme')
     assert_equal 'my-shiny-theme', p.theme
   end
 
@@ -1144,7 +1144,7 @@ class ProfileTest < ActiveSupport::TestCase
     env = fast_create(Environment)
 
     p1 = fast_create(Profile, :identifier => 'mytestprofile', :environment_id => env.id)
-    p2 = Profile.new(:identifier => 'mytestprofile', :environment => env)
+    p2 = build(Profile, :identifier => 'mytestprofile', :environment => env)
 
     assert !p2.valid?
     assert p2.errors.on(:identifier)
@@ -1199,14 +1199,14 @@ class ProfileTest < ActiveSupport::TestCase
   should 'enable contact for person only if its features enabled in environment' do
     env = Environment.default
     env.disable('disable_contact_person')
-    person = Person.new(:name => 'Contacted', :environment => env)
+    person = build(Person, :name => 'Contacted', :environment => env)
     assert person.enable_contact?
   end
 
   should 'enable contact for community only if its features enabled in environment' do
     env = Environment.default
     env.disable('disable_contact_person')
-    community = Community.new(:name => 'Contacted', :environment => env)
+    community = build(Community, :name => 'Contacted', :environment => env)
     assert community.enable_contact?
   end
 
@@ -1322,7 +1322,7 @@ class ProfileTest < ActiveSupport::TestCase
   end
 
   should 'profile be valid when image is empty' do
-    profile = Profile.new(:image_builder => {:uploaded_data => ""})
+    profile = build(Profile, :image_builder => {:uploaded_data => ""})
     profile.valid?
     assert_nil profile.errors[:image]
   end
@@ -1346,7 +1346,7 @@ class ProfileTest < ActiveSupport::TestCase
 
   should 'not have a profile as a template if it is not defined as a template' do
     template = fast_create(Profile)
-    profile = Profile.new(:template => template)
+    profile = build(Profile, :template => template)
     !profile.valid?
     assert profile.errors[:template.to_s].present?
 
@@ -1752,22 +1752,22 @@ class ProfileTest < ActiveSupport::TestCase
 
   should 'get organization roles' do
     env = fast_create(Environment)
-    roles = %w(foo bar profile_foo profile_bar).map{ |r| Role.create!(:name => r, :key => r, :environment_id => env.id, :permissions => ["some"]) }
-    Role.create! :name => 'test', :key => 'profile_test', :environment_id => env.id + 1
+    roles = %w(foo bar profile_foo profile_bar).map{ |r| create(Role, :name => r, :key => r, :environment_id => env.id, :permissions => ["some"]) }
+    create Role, :name => 'test', :key => 'profile_test', :environment_id => env.id + 1
     Profile::Roles.expects(:all_roles).returns(roles)
     assert_equal roles[2..3], Profile::Roles.organization_member_roles(env.id)
   end
 
   should 'get all roles' do
     env = fast_create(Environment)
-    roles = %w(foo bar profile_foo profile_bar).map{ |r| Role.create!(:name => r, :environment_id => env.id, :permissions => ["some"]) }
-    Role.create! :name => 'test', :environment_id => env.id + 1
+    roles = %w(foo bar profile_foo profile_bar).map{ |r| create(Role, :name => r, :environment_id => env.id, :permissions => ["some"]) }
+    create Role, :name => 'test', :environment_id => env.id + 1
     assert_equal roles, Profile::Roles.all_roles(env.id)
   end
 
   should 'define method for role' do
     env = fast_create(Environment)
-    r = Role.create! :name => 'Test Role', :environment_id => env.id
+    r = create Role, :name => 'Test Role', :environment_id => env.id
     assert_equal r, Profile::Roles.test_role(env.id)
     assert_raise NoMethodError do
       Profile::Roles.invalid_role(env.id)
diff --git a/test/unit/scrap_test.rb b/test/unit/scrap_test.rb
index b2f004d..db52d47 100644
--- a/test/unit/scrap_test.rb
+++ b/test/unit/scrap_test.rb
@@ -289,7 +289,7 @@ class ScrapTest < ActiveSupport::TestCase
     s, r = fast_create(Person), fast_create(Person)
     root = fast_create(Scrap, :sender_id => s.id, :receiver_id => r.id)
     assert_difference ActionTracker::Record, :count, 1 do
-      reply = Scrap.create!(:sender => r, :receiver => s, :scrap_id => root.id, :content => 'sample')
+      reply = create(Scrap, :sender => r, :receiver => s, :scrap_id => root.id, :content => 'sample')
     end
     activity = ActionTracker::Record.last
     assert_equal 'reply_scrap_on_self', activity.verb.to_s
diff --git a/test/unit/tags_block_test.rb b/test/unit/tags_block_test.rb
index 0c257dc..595ebb9 100644
--- a/test/unit/tags_block_test.rb
+++ b/test/unit/tags_block_test.rb
@@ -35,8 +35,8 @@ class TagsBlockTest < ActiveSupport::TestCase
     @otheruser = create_user('othertestinguser').person
     @otheruser.articles.build(:name => 'article A', :tag_list => 'other-tag').save!
     @otheruser.articles.build(:name => 'article B', :tag_list => 'other-tag, second-tag').save!
-    box = Box.create!(:owner => Environment.default)
-    @block = TagsBlock.create!(:box => box)
+    box = create(Box, :owner => Environment.default)
+    @block = create(TagsBlock, :box => box)
 
     assert_match /\/tag\/first-tag" [^>]+"3 items"/,  block.content
     assert_match /\/tag\/second-tag" [^>]+"3 items"/, block.content
--
libgit2 0.21.2