cafe-grader-web Commit - r757:35d86dd3635c

cafe-grader-web

Commit `r757:35d86dd3635c` public

parent | child

Description:

fix user.admin? bug

Commit status:

[Not Reviewed]

References:

algo

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r757:35d86dd3635c - Fri, 12 Jul 2019 10:30:02 - 2 files changed: 5 inserted, 4 deleted

app/controllers/application_controller.rb ¶ +4 -3

               require 'ipaddr'
               class ApplicationController < ActionController::Base
                 protect_from_forgery
                 before_action :current_user
                 SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode'
                 MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login'
                 ALLOW_WHITELIST_IP_ONLY_CONF_KEY = 'right.allow_whitelist_ip_only'
                 WHITELIST_IP_CONF_KEY = 'right.whitelist_ip'
                 #report and redirect for unauthorized activities
                 def unauthorized_redirect(notice = 'You are not authorized to view the page you requested')
                   flash[:notice] = notice
                   redirect_to login_main_path
                 end
                 # Returns the current logged-in user (if any).
                 def current_user
                   return nil unless session[:user_id]
                   @current_user ||= User.find(session[:user_id])
                 end
                 def admin_authorization
                   return false unless check_valid_login
                   user = User.includes(:roles).find(session[:user_id])
                   unless user.admin?
                     unauthorized_redirect
                     return false
                   end
                   return true
                 end
                 def authorization_by_roles(allowed_roles)
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role| allowed_roles.member?(role.name) }
                     unauthorized_redirect
                     return false
                   end
                 end
                 def testcase_authorization
                   #admin always has privileged
                   if @current_user.admin?
                     return true
                   end
                   unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
                 end
                 protected
                 #redirect to root (and also force logout)
                 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
                 def check_valid_login
                   #check if logged in
                   unless session[:user_id]
                     if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                       unauthorized_redirect('You need to login but you cannot log in at this time')
                     else
                       unauthorized_redirect('You need to login')
                     end
                     return false
                   end
                   # check if run in single user mode
                   if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
-            -       if @current_user==nil || (not @current_user.admin?)
+            +       if @current_user==nil || (!@current_user.admin?)
                       unauthorized_redirect('You cannot log in at this time')
                       return false
                     end
                   end
                   # check if the user is enabled
                   unless @current_user.enabled? || @current_user.admin?
                     unauthorized_redirect 'Your account is disabled'
                     return false
                   end
                   # check if user ip is allowed
                   unless @current_user.admin? || !GraderConfiguration[ALLOW_WHITELIST_IP_ONLY_CONF_KEY]
                     unless is_request_ip_allowed?
                       unauthorized_redirect 'Your IP is not allowed'
                       return false
                     end
                   end
                   if GraderConfiguration.multicontests?
                     return true if @current_user.admin?
                     begin
                       if @current_user.contest_stat(true).forced_logout
                         flash[:notice] = 'You have been automatically logged out.'
                         redirect_to :controller => 'main', :action => 'index'
                       end
                     rescue
                     end
                   end
                   return true
                 end
                 #redirect to root (and also force logout)
                 #if the user use different ip from the previous connection
                 #  only applicable when MULTIPLE_IP_LOGIN options is false only
                 def authenticate_by_ip_address
                   #this assume that we have already authenticate normally
                   unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
                     user = User.find(session[:user_id])
-            -       if (not @current_user.admin? && user.last_ip && user.last_ip != request.remote_ip)
+            +       puts "User admin #{user.admin?}"
+            +       if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
                       flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
+            +         puts "hahaha"
                       redirect_to :controller => 'main', :action => 'login'
-            -         puts "CHEAT: user #{user.login} tried to login from '#{request.remote_ip}' while last ip is '#{user.last_ip}' at #{Time.zone.now}"
                       return false
                     end
                     unless user.last_ip
                       user.last_ip = request.remote_ip
                       user.save
                     end
                   end
                   return true
                 end
                 def authorization
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role|
                       role.rights.detect{ |right|
                         right.controller == self.class.controller_name and
                           (right.action == 'all' || right.action == action_name)
                       }
                     }
                     flash[:notice] = 'You are not authorized to view the page you requested'
                     #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 def verify_time_limit
                   return true if session[:user_id]==nil
                   user = User.find(session[:user_id], :include => :site)
                   return true if user==nil || user.site == nil
                   if user.contest_finished?
                     flash[:notice] = 'Error: the contest you are participating is over.'
                     redirect_to :back
                     return false
                   end
                   return true
                 end
                 def is_request_ip_allowed?
                   if GraderConfiguration[ALLOW_WHITELIST_IP_ONLY_CONF_KEY]
                     user_ip = IPAddr.new(request.remote_ip)
                     GraderConfiguration[WHITELIST_IP_LIST_CONF_KEY].delete(' ').split(',').each do |ips|
                       allow_ips = IPAddr.new(ips)
                       unless allow_ips.includes(user_ip)
                         return false
                       end
                     end
                   end
                   return true
                 end
               end

app/models/user.rb ¶ +1 -1

               require 'digest/sha1'
               require 'net/pop'
               require 'net/https'
               require 'net/http'
               require 'json'
               class User < ActiveRecord::Base
                 has_and_belongs_to_many :roles
                 #has_and_belongs_to_many :groups
                 has_many :groups_users, class_name: 'GroupUser'
                 has_many :groups, :through => :groups_users
                 has_many :test_requests, -> {order(submitted_at: :desc)}
                 has_many :messages, -> { order(created_at: :desc) },
                          :class_name => "Message",
                          :foreign_key => "sender_id"
                 has_many :replied_messages, -> { order(created_at: :desc) },
                          :class_name => "Message",
                          :foreign_key => "receiver_id"
                 has_one :contest_stat, :class_name => "UserContestStat", :dependent => :destroy
                 belongs_to :site
                 belongs_to :country
                 has_and_belongs_to_many :contests, -> { order(:name)}
                 scope :activated_users, -> {where activated: true}
                 validates_presence_of :login
                 validates_uniqueness_of :login
                 validates_format_of :login, :with => /\A[\_A-Za-z0-9]+\z/
                 validates_length_of :login, :within => 3..30
                 validates_presence_of :full_name
                 validates_length_of :full_name, :minimum => 1
                 validates_presence_of :password, :if => :password_required?
                 validates_length_of :password, :within => 4..20, :if => :password_required?
                 validates_confirmation_of :password, :if => :password_required?
                 validates_format_of :email,
                                     :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i,
                                     :if => :email_validation?
                 validate :uniqueness_of_email_from_activated_users,
                          :if => :email_validation?
                 validate :enough_time_interval_between_same_email_registrations,
                          :if => :email_validation?
                 # these are for ytopc
                 # disable for now
                 #validates_presence_of :province
                 attr_accessor :password
                 before_save :encrypt_new_password
                 before_save :assign_default_site
                 before_save :assign_default_contest
                 # this is for will_paginate
                 cattr_reader :per_page
                 @@per_page = 50
                 def self.authenticate(login, password)
                   user = find_by_login(login)
                   if user
                     return user if user.authenticated?(password)
                   end
                 end
                 def authenticated?(password)
                   if self.activated
                     hashed_password == User.encrypt(password,self.salt)
                   else
                     false
                   end
                 end
                 def admin?
-            -     self.roles.detect {|r| r.name == 'admin' }
+            +     self.roles.where(name: 'admin').count > 0
                 end
                 def email_for_editing
                   if self.email==nil
                     "(unknown)"
                   elsif self.email==''
                     "(blank)"
                   else
                     self.email
                   end
                 end
                 def email_for_editing=(e)
                   self.email=e
                 end
                 def alias_for_editing
                   if self.alias==nil
                     "(unknown)"
                   elsif self.alias==''
                     "(blank)"
                   else
                     self.alias
                   end
                 end
                 def alias_for_editing=(e)
                   self.alias=e
                 end
                 def activation_key
                   if self.hashed_password==nil
                     encrypt_new_password
                   end
                   Digest::SHA1.hexdigest(self.hashed_password)[0..7]
                 end
                 def verify_activation_key(key)
                   key == activation_key
                 end
                 def self.random_password(length=5)
                   chars = 'abcdefghjkmnopqrstuvwxyz'
                   password = ''
                   length.times { password << chars[rand(chars.length - 1)] }
                   password
                 end
                 def self.find_non_admin_with_prefix(prefix='')
                   users = User.all
                   return users.find_all { |u| !(u.admin?) and u.login.index(prefix)==0 }
                 end
                 # Contest information
                 def self.find_users_with_no_contest()
                   users = User.all
                   return users.find_all { |u| u.contests.length == 0 }
                 end
                 def contest_time_left
                   if GraderConfiguration.contest_mode?
                     return nil if site==nil
                     return site.time_left
                   elsif GraderConfiguration.indv_contest_mode?
                     time_limit = GraderConfiguration.contest_time_limit
                     if time_limit == nil
                       return nil
                     end
                     if contest_stat==nil or contest_stat.started_at==nil
                       return (Time.now.gmtime + time_limit) - Time.now.gmtime
                     else
                       finish_time = contest_stat.started_at + time_limit
                       current_time = Time.now.gmtime
                       if current_time > finish_time
                         return 0
                       else
                         return finish_time - current_time
                       end
                     end
                   else
                     return nil
                   end
                 end
                 def contest_finished?
                   if GraderConfiguration.contest_mode?
                     return false if site==nil
                     return site.finished?
                   elsif GraderConfiguration.indv_contest_mode?
                     return false if self.contest_stat==nil
                     return contest_time_left == 0
                   else
                     return false
                   end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r757:35d86dd3635c - Fri, 12 Jul 2019 10:30:02 - 2 files changed: 5 inserted, 4 deleted

Sign in to your account

Commit r757:35d86dd3635c public

Author

r757:35d86dd3635c - Fri, 12 Jul 2019 10:30:02 - 2 files changed: 5 inserted, 4 deleted

Commit `r757:35d86dd3635c` public