cafe-grader-web Commit - r803:30dd5b343f6b

cafe-grader-web

Commit `r803:30dd5b343f6b` public

parent | child

Description:

allow ta to view problem stat

Commit status:

[Not Reviewed]

References:

default

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r803:30dd5b343f6b - Mon, 28 Sep 2020 15:02:59 - 2 files changed: 5 inserted, 3 deleted

app/controllers/application_controller.rb ¶ +1 -2

               require 'ipaddr'
               class ApplicationController < ActionController::Base
                 protect_from_forgery
                 before_action :current_user
                 SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode'
                 MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login'
                 WHITELIST_IGNORE_CONF_KEY = 'right.whitelist_ignore'
                 WHITELIST_IP_CONF_KEY = 'right.whitelist_ip'
                 #report and redirect for unauthorized activities
                 def unauthorized_redirect(notice = 'You are not authorized to view the page you requested')
                   flash[:notice] = notice
                   redirect_to login_main_path
                 end
                 # Returns the current logged-in user (if any).
                 def current_user
                   return nil unless session[:user_id]
                   @current_user ||= User.find(session[:user_id])
                 end
                 def admin_authorization
                   return false unless check_valid_login
                   user = User.includes(:roles).find(session[:user_id])
                   unless user.admin?
                     unauthorized_redirect
                     return false
                   end
                   return true
                 end
                 def authorization_by_roles(allowed_roles)
                   return false unless check_valid_login
-            -     user = User.find(session[:user_id])
+            +     unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
-            -     unless user.roles.detect { |role| allowed_roles.member?(role.name) }
                     unauthorized_redirect
                     return false
                   end
                 end
                 def testcase_authorization
                   #admin always has privileged
                   if @current_user.admin?
                     return true
                   end
                   unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
                 end
                 protected
                 #redirect to root (and also force logout)
                 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
                 def check_valid_login
                   #check if logged in
                   unless session[:user_id]
                     if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                       unauthorized_redirect('You need to login but you cannot log in at this time')
                     else
                       unauthorized_redirect('You need to login')
                     end
                     return false
                   end
                   # check if run in single user mode
                   if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                     if @current_user==nil || (!@current_user.admin?)
                       unauthorized_redirect('You cannot log in at this time')
                       return false
                     end
                   end
                   # check if the user is enabled
                   unless @current_user.enabled? || @current_user.admin?
                     unauthorized_redirect 'Your account is disabled'
                     return false
                   end
                   # check if user ip is allowed
                   unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     unless is_request_ip_allowed?
                       unauthorized_redirect 'Your IP is not allowed to login at this time.'
                       return false
                     end
                   end
                   if GraderConfiguration.multicontests?
                     return true if @current_user.admin?
                     begin
                       if @current_user.contest_stat(true).forced_logout
                         flash[:notice] = 'You have been automatically logged out.'
                         redirect_to :controller => 'main', :action => 'index'
                       end
                     rescue
                     end
                   end
                   return true
                 end
                 #redirect to root (and also force logout)
                 #if the user use different ip from the previous connection
                 #  only applicable when MULTIPLE_IP_LOGIN options is false only
                 def authenticate_by_ip_address
                   #this assume that we have already authenticate normally
                   unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
                     user = User.find(session[:user_id])
                     if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
                       flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
                       redirect_to :controller => 'main', :action => 'login'
                       return false
                     end
                     unless user.last_ip
                       user.last_ip = request.remote_ip
                       user.save
                     end
                   end
                   return true
                 end
                 def authorization
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role|
                       role.rights.detect{ |right|
                         right.controller == self.class.controller_name and
                           (right.action == 'all' || right.action == action_name)
                       }
                     }
                     flash[:notice] = 'You are not authorized to view the page you requested'
                     #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 def verify_time_limit
                   return true if session[:user_id]==nil
                   user = User.find(session[:user_id], :include => :site)
                   return true if user==nil || user.site == nil
                   if user.contest_finished?
                     flash[:notice] = 'Error: the contest you are participating is over.'
                     redirect_to :back
                     return false
                   end
                   return true
                 end
                 def is_request_ip_allowed?
                   unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     user_ip = IPAddr.new(request.remote_ip)
                     allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || ''
                     allowed.delete(' ').split(',').each do |ips|
                       allow_ips = IPAddr.new(ips)
                       if allow_ips.include?(user_ip)
                         return true
                       end
                     end
                     return false
                   end
                   return true
                 end
                 #function for datatable ajax query
                 #return record,total_count,filter_count
                 def process_query_record(record,
                                          total_count: nil,
                                          select: '',
                                          global_search: [],
                                          no_search: false,
                                          force_order: '',
                                          date_filter: '', date_param_since: 'date_since',date_param_until: 'date_until',
                                          hard_limit: nil)
                   arel_table = record.model.arel_table
                   if !no_search && params['search']
                     global_value = record.model.sanitize_sql(params['search']['value'].strip.downcase)
                     if !global_value.blank?
                       global_value.split.each do |value|
                         global_where = global_search.map{|f| "LOWER(#{f}) like '%#{value}%'"}.join(' OR ')
                         record = record.where(global_where)
                       end
                     end
                     params['columns'].each do |i, col|
                       if !col['search']['value'].blank?
                         record = record.where(arel_table[col['name']].lower.matches("%#{col['search']['value'].strip.downcase}%"))
                       end
                     end
                   end
                   if !date_filter.blank?
                     param_since = params[date_param_since]
                     param_until = params[date_param_until]
                     date_since = Time.zone.parse( param_since ) || Time.new(1,1,1) rescue Time.new(1,1,1)
                     date_until = Time.zone.parse( param_until ) || Time.zone.now() rescue Time.zone.now()
                     date_range = date_since..(date_until.end_of_day)
                     record = record.where(date_filter.to_sym => date_range)
                   end
                   if force_order.blank?
                     if params['order']
                       params['order'].each do |i, o|
                         colName = params['columns'][o['column']]['name']
                         colName = "#{record.model.table_name}.#{colName}" if colName.upcase == 'ID'
                         record = record.order("#{colName} #{o['dir'].casecmp('desc') != 0 ? 'ASC' : 'DESC'}") unless colName.blank?
                       end
                     end
                   else
                     record = record.order(force_order)
                   end
                   filterCount = record.count(record.model.primary_key)
                   # if .group() is used, filterCount might be like {id_1: count_1, id_2: count_2, ...}
                   # so we should count the result again..
                   if filterCount.is_a? Hash
                     filterCount = filterCount.count
                   end
                   record = record.offset(params['start'] || 0)
                   record = record.limit(hard_limit)
                   if (params['length'])
                     limit = params['length'].to_i
                     limit == hard_limit if (hard_limit && hard_limit < limit)
                     record = record.limit(limit)

app/controllers/problems_controller.rb ¶ +4 -1

               class ProblemsController < ApplicationController
-            -   before_action :admin_authorization
+            +   before_action :admin_authorization, except: [:stat]
+            +   before_action only: [:stat] do
+            +     authorization_by_roles(['admin','ta'])
+            +   end
                 in_place_edit_for :problem, :name
                 in_place_edit_for :problem, :full_name
                 in_place_edit_for :problem, :full_score
                 def index
                   @problems = Problem.order(date_added: :desc)
                 end
                 def show
                   @problem = Problem.find(params[:id])
                 end
                 def new
                   @problem = Problem.new
                   @description = nil
                 end
                 def create
                   @problem = Problem.new(problem_params)
                   @description = Description.new(description_params)
                   if @description.body!=''
                     if !@description.save
                       render :action => new and return
                     end
                   else
                     @description = nil
                   end
                   @problem.description = @description
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     render :action => 'new'
                   end
                 end
                 def quick_create
                   @problem = Problem.new(problem_params)
                   @problem.full_name = @problem.name if @problem.full_name == ''
                   @problem.full_score = 100
                   @problem.available = false
                   @problem.test_allowed = true
                   @problem.output_only = false
                   @problem.date_added = Time.new
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     flash[:notice] = 'Error saving problem'
                   redirect_to action: :index
                   end
                 end
                 def edit
                   @problem = Problem.find(params[:id])
                   @description = @problem.description
                 end
                 def update
                   @problem = Problem.find(params[:id])
                   @description = @problem.description
                   if @description.nil? and params[:description][:body]!=''
                     @description = Description.new(description_params)
                     if !@description.save
                       flash[:notice] = 'Error saving description'
                       render :action => 'edit' and return
                     end
                     @problem.description = @description
                   elsif @description
                     if !@description.update_attributes(description_params)
                       flash[:notice] = 'Error saving description'
                       render :action => 'edit' and return
                     end
                   end
                   if params[:file] and params[:file].content_type != 'application/pdf'
                       flash[:notice] = 'Error: Uploaded file is not PDF'
                       render :action => 'edit' and return
                   end
                   if @problem.update_attributes(problem_params)
                     flash[:notice] = 'Problem was successfully updated.'
                     unless params[:file] == nil or params[:file] == ''
                       flash[:notice] = 'Problem was successfully updated and a new PDF file is uploaded.'
                       out_dirname = "#{Problem.download_file_basedir}/#{@problem.id}"
                       if not FileTest.exists? out_dirname
                         Dir.mkdir out_dirname
                       end
                       out_filename = "#{out_dirname}/#{@problem.name}.pdf"
                       if FileTest.exists? out_filename
                         File.delete out_filename
                       end
                       File.open(out_filename,"wb") do |file|
                         file.write(params[:file].read)
                       end
                       @problem.description_filename = "#{@problem.name}.pdf"
                       @problem.save
                     end
                     redirect_to :action => 'show', :id => @problem
                   else
                     render :action => 'edit'
                   end
                 end
                 def destroy
                   p = Problem.find(params[:id]).destroy
                   redirect_to action: :index
                 end
                 def toggle
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(available: !(@problem.available) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def toggle_test
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(test_allowed: !(@problem.test_allowed?) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def toggle_view_testcase
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(view_testcase: !(@problem.view_testcase?) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def turn_all_off
                   Problem.available.all.each do |problem|
                     problem.available = false
                     problem.save
                   end
                   redirect_to action: :index
                 end
                 def turn_all_on
                   Problem.where.not(available: true).each do |problem|
                     problem.available = true
                     problem.save
                   end
                   redirect_to action: :index
                 end
                 def stat
                   @problem = Problem.find(params[:id])
                   unless @problem.available or session[:admin]
                     redirect_to :controller => 'main', :action => 'list'
                     return
                   end
                   @submissions = Submission.includes(:user).includes(:language).where(problem_id: params[:id]).order(:user_id,:id)
                   #stat summary
                   range =65
                   @histogram = { data: Array.new(range,0), summary: {} }
                   user = Hash.new(0)
                   @submissions.find_each do |sub|
                     d = (DateTime.now.in_time_zone - sub.submitted_at) / 24 / 60 / 60
                     @histogram[:data][d.to_i] += 1 if d < range
                     user[sub.user_id] = [user[sub.user_id], ((sub.try(:points) || 0) >= @problem.full_score) ? 1 : 0].max
                   end
                   @histogram[:summary][:max] = [@histogram[:data].max,1].max
                   @summary = { attempt: user.count, solve: 0 }
                   user.each_value { |v| @summary[:solve] += 1 if v == 1 }
                 end
                 def manage
                   @problems = Problem.order(date_added: :desc)
                 end
                 def do_manage
                   if params.has_key? 'change_date_added' and params[:date_added].strip.empty? == false
                     change_date_added
                   elsif params.has_key? 'add_to_contest'
                     add_to_contest
                   elsif params.has_key? 'enable_problem'
                     set_available(true)
                   elsif params.has_key? 'disable_problem'
                     set_available(false)
                   elsif params.has_key? 'add_group'
                     group = Group.find(params[:group_id])
                     ok = []
                     failed = []
                     get_problems_from_params.each do |p|

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r803:30dd5b343f6b - Mon, 28 Sep 2020 15:02:59 - 2 files changed: 5 inserted, 3 deleted

Sign in to your account

Commit r803:30dd5b343f6b public

Author

r803:30dd5b343f6b - Mon, 28 Sep 2020 15:02:59 - 2 files changed: 5 inserted, 3 deleted

Commit `r803:30dd5b343f6b` public