Description:
fixed form_tag/form_for, disabled attributes whitelist
Commit status:
[Not Reviewed]
References:
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Add another comment

r321:6490fd9a1f54 - - 17 files changed: 23 inserted, 22 deleted

@@ -58,7 +58,8
58 def submit
58 def submit
59 user = User.find(session[:user_id])
59 user = User.find(session[:user_id])
60
60
61 - @submission = Submission.new(params[:submission])
61 + @submission = Submission.new
62 + @submission.problem_id = params[:submission][:problem_id]
62 @submission.user = user
63 @submission.user = user
63 @submission.language_id = 0
64 @submission.language_id = 0
64 if (params['file']) and (params['file']!='')
65 if (params['file']) and (params['file']!='')
@@ -11,16 +11,16
11 .item
11 .item
12 Grader control:
12 Grader control:
13 .item
13 .item
14 - - form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
14 + = form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
15 = submit_tag 'Start graders in grading env'
15 = submit_tag 'Start graders in grading env'
16 .item
16 .item
17 - - form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
17 + = form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
18 = submit_tag 'Start graders in exam env'
18 = submit_tag 'Start graders in exam env'
19 .item
19 .item
20 - - form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
20 + = form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
21 = submit_tag 'Stop all running graders'
21 = submit_tag 'Stop all running graders'
22 .item
22 .item
23 - - form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
23 + = form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
24 = submit_tag 'Clear all data'
24 = submit_tag 'Clear all data'
25 %br{:style => 'clear:both'}/
25 %br{:style => 'clear:both'}/
26
26
@@ -45,7 +45,7
45
45
46 %h2 Terminated graders
46 %h2 Terminated graders
47
47
48 - - form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
48 + = form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
49 = submit_tag 'Clear data for terminated graders'
49 = submit_tag 'Clear data for terminated graders'
50
50
51 = render :partial => 'grader_list', :locals => {:grader_list => @terminated_processes}
51 = render :partial => 'grader_list', :locals => {:grader_list => @terminated_processes}
@@ -12,5 +12,5
12
12
13 =t 'main.confirm_contest_start.timer_starts_after_click'
13 =t 'main.confirm_contest_start.timer_starts_after_click'
14
14
15 - - form_tag :action => 'confirm_contest_start', :method => 'post' do
15 + = form_tag :action => 'confirm_contest_start', :method => 'post' do
16 = submit_tag t('main.confirm_contest_start.start_button'), :confirm => t('main.confirm_contest_start.start_button_confirm')
16 = submit_tag t('main.confirm_contest_start.start_button'), :confirm => t('main.confirm_contest_start.start_button_confirm')
@@ -14,7 +14,7
14 (4) **INVALID QUESTION**, and
14 (4) **INVALID QUESTION**, and
15 (5) **NO COMMENT**.
15 (5) **NO COMMENT**.
16
16
17 - - form_for 'message', nil, :url => { :action => 'create'} do |f|
17 + = form_for 'message', nil, :url => { :action => 'create'} do |f|
18 %p
18 %p
19 %b New clarification request
19 %b New clarification request
20 = submit_tag "Post"
20 = submit_tag "Post"
@@ -6,7 +6,7
6 .body= simple_format(@message.body)
6 .body= simple_format(@message.body)
7
7
8 %h3 Your reply:
8 %h3 Your reply:
9 - - form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
9 + = form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
10 = f.text_area :body, :rows => 5, :cols => 100
10 = f.text_area :body, :rows => 5, :cols => 100
11 = f.hidden_field :receiver_id, {:value => @message.sender_id }
11 = f.hidden_field :receiver_id, {:value => @message.sender_id }
12 = f.hidden_field :replying_message_id, {:value => @message.id }
12 = f.hidden_field :replying_message_id, {:value => @message.id }
@@ -9,7 +9,7
9 - if @problem and @problem.errors
9 - if @problem and @problem.errors
10 =error_messages_for 'problem'
10 =error_messages_for 'problem'
11
11
12 - - form_tag({:action => 'do_import'}, :multipart => true) do
12 + = form_tag({:action => 'do_import'}, :multipart => true) do
13 .submitbox
13 .submitbox
14 %table
14 %table
15 %tr
15 %tr
@@ -6,7 +6,7
6
6
7 %p= link_to '[Back to problem list]', :action => 'list'
7 %p= link_to '[Back to problem list]', :action => 'list'
8
8
9 - - form_tag :action=>'do_manage' do
9 + = form_tag :action=>'do_manage' do
10 .submitbox
10 .submitbox
11 What do you want to do?
11 What do you want to do?
12 %br/
12 %br/
@@ -15,7 +15,7
15 %h2 For Site Administrator.
15 %h2 For Site Administrator.
16
16
17 - if @default_site
17 - if @default_site
18 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
18 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
19 %b Log in for default site.
19 %b Log in for default site.
20 = f.hidden_field :site_id, :value => @default_site.id
20 = f.hidden_field :site_id, :value => @default_site.id
21 %br/
21 %br/
@@ -25,7 +25,7
25
25
26 - else
26 - else
27 Please select your country and site and login.
27 Please select your country and site and login.
28 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
28 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
29 Country:
29 Country:
30 = select :site_country, :id, @country_select_with_all, {}, {:onchange => "updateSiteList();", :onclick => "updateSiteList();" }
30 = select :site_country, :id, @country_select_with_all, {}, {:onchange => "updateSiteList();", :onclick => "updateSiteList();" }
31 Site:
31 Site:
@@ -11,7 +11,7
11 %br/
11 %br/
12 %br/
12 %br/
13
13
14 - - form_tag :action => 'start' do
14 + = form_tag :action => 'start' do
15 When you're ready, you can click the button below to start the contest.
15 When you're ready, you can click the button below to start the contest.
16 %br/
16 %br/
17 Please make sure that the contestants are ready.
17 Please make sure that the contestants are ready.
@@ -40,7 +40,7
40 <% if GraderConfiguration.show_submitbox_to?(@user) and GraderConfiguration.allow_test_request(@user) %>
40 <% if GraderConfiguration.show_submitbox_to?(@user) and GraderConfiguration.allow_test_request(@user) %>
41 <div class="submitbox">
41 <div class="submitbox">
42 <%= error_messages_for 'submitted_test_request' %>
42 <%= error_messages_for 'submitted_test_request' %>
43 - <% form_for :test_request, nil,
43 + <%= form_for :test_request, nil,
44 :url => { :action => 'submit'},
44 :url => { :action => 'submit'},
45 :html => { :multipart => true } do |f| %>
45 :html => { :multipart => true } do |f| %>
46 <table>
46 <table>
@@ -16,7 +16,7
16 = link_to '[revoke]', :action => 'revoke_admin', :id => user.id
16 = link_to '[revoke]', :action => 'revoke_admin', :id => user.id
17 %hr
17 %hr
18
18
19 - - form_tag :action => 'grant_admin' do
19 + = form_tag :action => 'grant_admin' do
20 Grant admin permission to:
20 Grant admin permission to:
21 = text_field_tag 'login'
21 = text_field_tag 'login'
22 = submit_tag 'Grant'
22 = submit_tag 'Grant'
@@ -1,6 +1,6
1 %h1 Bulk edit users in contests
1 %h1 Bulk edit users in contests
2
2
3 - - form_tag :action => 'manage_contest' do
3 + = form_tag :action => 'manage_contest' do
4 List users' login below; one per line.
4 List users' login below; one per line.
5 %br/
5 %br/
6 = text_area_tag 'login_list', nil, :rows => 23, :cols => 80
6 = text_area_tag 'login_list', nil, :rows => 23, :cols => 80
@@ -1,6 +1,6
1 %h1 Send mass e-mails
1 %h1 Send mass e-mails
2
2
3 - - form_tag :action => 'bulk_mail' do
3 + = form_tag :action => 'bulk_mail' do
4 %b List recipients' login below; one per line.
4 %b List recipients' login below; one per line.
5 %br/
5 %br/
6 = text_area_tag 'login_list', nil, :rows => 7, :cols => 80
6 = text_area_tag 'login_list', nil, :rows => 7, :cols => 80
@@ -9,7 +9,7
9
9
10 %br/
10 %br/
11
11
12 - - form_tag :action => 'retrieve_password' do
12 + = form_tag :action => 'retrieve_password' do
13 =t 'registration.password_retrieval.instructions'
13 =t 'registration.password_retrieval.instructions'
14 = text_field 'email', nil, :size => 20
14 = text_field 'email', nil, :size => 20
15 %br/
15 %br/
@@ -24,7 +24,7
24 %tr
24 %tr
25 %th.uinfo Password
25 %th.uinfo Password
26 %td.uinfo
26 %td.uinfo
27 - - form_tag :action => 'chg_passwd', :method => 'post' do
27 + = form_tag :action => 'chg_passwd', :method => 'post' do
28 %table
28 %table
29 %tr
29 %tr
30 %td= password_field_tag 'passwd'
30 %td= password_field_tag 'passwd'
@@ -8,7 +8,7
8 = error_messages_for :user, :header_message => (t 'registration.errors.header')
8 = error_messages_for :user, :header_message => (t 'registration.errors.header')
9
9
10 %table
10 %table
11 - - form_for :user, @user, :url => { :action => 'register' } do |f|
11 + = form_for :user, @user, :url => { :action => 'register' } do |f|
12 %tr
12 %tr
13 %td{:align => "right"}
13 %td{:align => "right"}
14 = "#{t 'login_label'}:"
14 = "#{t 'login_label'}:"
@@ -51,7 +51,7
51 # This will create an empty whitelist of attributes available for mass-assignment for all models
51 # This will create an empty whitelist of attributes available for mass-assignment for all models
52 # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
52 # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
53 # parameters by using an attr_accessible or attr_protected declaration.
53 # parameters by using an attr_accessible or attr_protected declaration.
54 - config.active_record.whitelist_attributes = true
54 + config.active_record.whitelist_attributes = false
55
55
56 # Enable the asset pipeline
56 # Enable the asset pipeline
57 config.assets.enabled = false
57 config.assets.enabled = false
You need to be logged in to leave comments. Login now