FIX: Apply watched words to user fields

Currently we don’t apply watched words to custom user fields nor user
profile fields.
This led to users being able to use blocked words in their bio, location
or some custom user fields.

This patch addresses this issue by adding some validations so it’s not
possible anymore to save the User model or the UserProfile model if they
contain blocked words.

app/models/user.rb

@@ -114,6 +114,7 @@ class User < ActiveRecord::Base
   validates :name, user_full_name: true, if: :will_save_change_to_name?, length: { maximum: 255 }
   validates :ip_address, allowed_ip_address: { on: :create, message: :signup_not_allowed }
   validates :primary_email, presence: true
+  validates :custom_fields_values, watched_words: true
   validates_associated :primary_email, message: -> (_, user_email) { user_email[:value]&.errors[:email]&.first }
 
   after_initialize :add_trust_level
@@ -1791,6 +1792,10 @@ class User < ActiveRecord::Base
       )
     SQL
   end
+
+  def custom_fields_values
+    custom_fields.values.join(" ")
+  end
 end
 
 # == Schema Information

app/models/user_profile.rb

@@ -7,9 +7,11 @@ class UserProfile < ActiveRecord::Base
   belongs_to :granted_title_badge, class_name: "Badge"
   belongs_to :featured_topic, class_name: 'Topic'
 
-  validates :bio_raw, length: { maximum: 3000 }
+  validates :bio_raw, length: { maximum: 3000 }, watched_words: true
   validates :website, url: true, allow_blank: true, if: Proc.new { |c| c.new_record? || c.website_changed? }
   validates :user, presence: true
+  validates :location, watched_words: true
+
   before_save :cook
   after_save :trigger_badges
   after_save :pull_hotlinked_image