cafe-grader-web

Commit r321:6490fd9a1f54 public

parent | child
Description:
fixed form_tag/form_for, disabled attributes whitelist
Commit status:
[Not Reviewed]
References:
default
Diff options:
Raw Diff | Patch Diff | Download Diff | Ignore whitespace | Increase context
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Side by Side Unified
Expand All Files Collapse All Files Wide Mode Diff
Add another comment
Browse Files

r321:6490fd9a1f54 - - 17 files changed: 23 inserted, 22 deleted

Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -37,49 +37,50
37 37 # Hide login if in single user mode and the url does not
38 38 # explicitly specify /login
39 39 #
40 40 # logger.info "PATH: #{request.path}"
41 41 # if GraderConfiguration['system.single_user_mode'] and
42 42 # request.path!='/main/login'
43 43 # @hidelogin = true
44 44 # end
45 45
46 46 @announcements = Announcement.find_for_frontpage
47 47 render :action => 'login', :layout => 'empty'
48 48 end
49 49
50 50 def list
51 51 prepare_list_information
52 52 end
53 53
54 54 def help
55 55 @user = User.find(session[:user_id])
56 56 end
57 57
58 58 def submit
59 59 user = User.find(session[:user_id])
60 60
61 - @submission = Submission.new(params[:submission])
61 + @submission = Submission.new
62 + @submission.problem_id = params[:submission][:problem_id]
62 63 @submission.user = user
63 64 @submission.language_id = 0
64 65 if (params['file']) and (params['file']!='')
65 66 @submission.source = params['file'].read
66 67 @submission.source_filename = params['file'].original_filename
67 68 end
68 69 @submission.submitted_at = Time.new.gmtime
69 70
70 71 if GraderConfiguration.time_limit_mode? and user.contest_finished?
71 72 @submission.errors.add_to_base "The contest is over."
72 73 prepare_list_information
73 74 render :action => 'list' and return
74 75 end
75 76
76 77 if @submission.valid?
77 78 if @submission.save == false
78 79 flash[:notice] = 'Error saving your submission'
79 80 elsif Task.create(:submission_id => @submission.id,
80 81 :status => Task::STATUS_INQUEUE) == false
81 82 flash[:notice] = 'Error adding your submission to task queue'
82 83 end
83 84 else
84 85 prepare_list_information
85 86 render :action => 'list' and return
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,51 +1,51
1 1 - content_for :head do
2 2 = stylesheet_link_tag 'graders'
3 3 <meta http-equiv ="refresh" content="60"/>
4 4
5 5 %h1 Grader information
6 6
7 7 = link_to '[Refresh]', :action => 'list'
8 8 %br/
9 9
10 10 .submitbox
11 11 .item
12 12 Grader control:
13 13 .item
14 - - form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
14 + = form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
15 15 = submit_tag 'Start graders in grading env'
16 16 .item
17 - - form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
17 + = form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
18 18 = submit_tag 'Start graders in exam env'
19 19 .item
20 - - form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
20 + = form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
21 21 = submit_tag 'Stop all running graders'
22 22 .item
23 - - form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
23 + = form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
24 24 = submit_tag 'Clear all data'
25 25 %br{:style => 'clear:both'}/
26 26
27 27 - if @last_task
28 28 Last task:
29 29 = link_to "#{@last_task.id}", :action => 'view', :id => @last_task.id, :type => 'Task'
30 30
31 31 %br/
32 32
33 33 - if @last_test_request
34 34 Last test_request:
35 35 = link_to "#{@last_test_request.id}", :action => 'view', :id => @last_test_request.id, :type => 'TestRequest'
36 36
37 37
38 38 %h2 Current graders
39 39
40 40 = render :partial => 'grader_list', :locals => {:grader_list => @grader_processes}
41 41
42 42 %h2 Stalled graders
43 43
44 44 = render :partial => 'grader_list', :locals => {:grader_list => @stalled_processes}
45 45
46 46 %h2 Terminated graders
47 47
48 - - form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
48 + = form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
49 49 = submit_tag 'Clear data for terminated graders'
50 50
51 51 = render :partial => 'grader_list', :locals => {:grader_list => @terminated_processes}
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,16 +1,16
1 1 = user_title_bar(@user)
2 2
3 3 .announcementbox
4 4 %span{:class => 'title'}
5 5 =t 'main.confirm_contest_start.box_title'
6 6 .announcement
7 7 %center
8 8 =t 'main.confirm_contest_start.contest_list'
9 9 - @contests.each do |contest|
10 10 = contest.title
11 11 %br
12 12
13 13 =t 'main.confirm_contest_start.timer_starts_after_click'
14 14
15 - - form_tag :action => 'confirm_contest_start', :method => 'post' do
15 + = form_tag :action => 'confirm_contest_start', :method => 'post' do
16 16 = submit_tag t('main.confirm_contest_start.start_button'), :confirm => t('main.confirm_contest_start.start_button_confirm')
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,26 +1,26
1 1 = user_title_bar(@user)
2 2
3 3 .announcementbox
4 4 %span{:class => 'title'}
5 5 How to submit clarification requests
6 6 .announcement
7 7 %p
8 8 :markdown
9 9 The clarification requests should be phrased as yes/no questions.
10 10 The answers will be one of the following:
11 11 (1) **YES**,
12 12 (2) <b>NO</b>,
13 13 (3) **ANSWERED IN TASK DESCRIPTION (EXPLICITLY OR IMPLICITLY)**,
14 14 (4) **INVALID QUESTION**, and
15 15 (5) **NO COMMENT**.
16 16
17 - - form_for 'message', nil, :url => { :action => 'create'} do |f|
17 + = form_for 'message', nil, :url => { :action => 'create'} do |f|
18 18 %p
19 19 %b New clarification request
20 20 = submit_tag "Post"
21 21 %br/
22 22 = f.text_area :body, :rows => 5, :cols => 100
23 23
24 24 %hr/
25 25
26 26 = render :partial => 'message', :collection => @messages, :locals => {:reply => false}
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,20 +1,20
1 1 %h3 Message
2 2
3 3 .message
4 4 .stat
5 5 = "#{@message.sender.full_name} at #{@message.created_at}"
6 6 .body= simple_format(@message.body)
7 7
8 8 %h3 Your reply:
9 - - form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
9 + = form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
10 10 = f.text_area :body, :rows => 5, :cols => 100
11 11 = f.hidden_field :receiver_id, {:value => @message.sender_id }
12 12 = f.hidden_field :replying_message_id, {:value => @message.id }
13 13 = submit_tag "Post"
14 14
15 15 %p
16 16 If you do not want to reply, but want to hide this message from
17 17 console, you can
18 18 = link_to "[hide]", :action => 'hide', :id => @message.id
19 19 this message. (This message will be marked as replied.)
20 20
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,36 +1,36
1 1 - content_for :head do
2 2 = stylesheet_link_tag 'problems'
3 3 = javascript_include_tag :defaults
4 4
5 5 %h1 Import problems
6 6
7 7 %p= link_to '[Back to problem list]', :action => 'list'
8 8
9 9 - if @problem and @problem.errors
10 10 =error_messages_for 'problem'
11 11
12 - - form_tag({:action => 'do_import'}, :multipart => true) do
12 + = form_tag({:action => 'do_import'}, :multipart => true) do
13 13 .submitbox
14 14 %table
15 15 %tr
16 16 %td Name:
17 17 %td= text_field_tag 'name'
18 18 %tr
19 19 %td Full name:
20 20 %td
21 21 = text_field_tag 'full_name'
22 22 %span{:class => 'help'} Leave blank to use the same value as the name above.
23 23 %tr
24 24 %td Testdata file:
25 25 %td= file_field_tag 'file'
26 26 %tr
27 27 %td
28 28 %td
29 29 %span{:class => 'help'}
30 30 In .zip, .tgz, tar.gz, .tar format.
31 31 It should includes inputs (e.g., 1.in, 2a.in, 2b.in)
32 32 and solutions (e.g., 1.sol, 2a.sol, 2b.sol).
33 33 %br/
34 34 You may put task description in *.html for raw html
35 35 and *.md or *.markdown for markdown.
36 36 - if @allow_test_pair_import
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,33 +1,33
1 1 - content_for :head do
2 2 = stylesheet_link_tag 'problems'
3 3 = javascript_include_tag :defaults
4 4
5 5 %h1 Manage problems
6 6
7 7 %p= link_to '[Back to problem list]', :action => 'list'
8 8
9 - - form_tag :action=>'do_manage' do
9 + = form_tag :action=>'do_manage' do
10 10 .submitbox
11 11 What do you want to do?
12 12 %br/
13 13 %ul
14 14 %li
15 15 Change date added to
16 16 = select_date Date.current, :prefix => 'date_added'
17 17 &nbsp;&nbsp;&nbsp;
18 18 = submit_tag 'Change', :name => 'change_date_added'
19 19
20 20 - if GraderConfiguration.multicontests?
21 21 %li
22 22 Add to
23 23 = select("contest","id",Contest.all.collect {|c| [c.title, c.id]})
24 24 = submit_tag 'Add', :name => 'add_to_contest'
25 25
26 26 %table
27 27 %tr
28 28 %th/
29 29 %th Name
30 30 %th Full name
31 31 %th Date added
32 32 - if GraderConfiguration.multicontests?
33 33 %th Contests
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,39 +1,39
1 1 %script{:type => 'text/javascript'}
2 2 var siteList = new Array();
3 3 - @countries.each do |country|
4 4 = "siteList[#{country.id}] = new Array();"
5 5 - country.sites.each do |site|
6 6 = "siteList[#{country.id}][#{site.id}] = \"#{site.name}\";"
7 7
8 8 var allSiteList = new Array();
9 9 - @site_select.each do |sel|
10 10 = "allSiteList[#{sel[1]}]=\"#{sel[0]}\";"
11 11
12 12 %script{:type => 'text/javascript', :src => '/javascripts/site_update.js'}
13 13
14 14 %div{ :style => "border: solid 1px gray; padding: 2px; background: #f0f0f0;"}
15 15 %h2 For Site Administrator.
16 16
17 17 - if @default_site
18 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
18 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
19 19 %b Log in for default site.
20 20 = f.hidden_field :site_id, :value => @default_site.id
21 21 %br/
22 22 Password:
23 23 = f.password_field :password
24 24 = submit_tag "Site Administrator Login"
25 25
26 26 - else
27 27 Please select your country and site and login.
28 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
28 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
29 29 Country:
30 30 = select :site_country, :id, @country_select_with_all, {}, {:onchange => "updateSiteList();", :onclick => "updateSiteList();" }
31 31 Site:
32 32 = select :login, :site_id, @site_select
33 33 %br/
34 34 Password:
35 35 = f.password_field :password
36 36 = submit_tag "Site Administrator Login"
37 37
38 38 %script{:type => 'text/javascript'}
39 39 updateSiteList();
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,24 +1,24
1 1 %h2
2 2 Contest Administration for site:
3 3 = "#{@site.name}, #{@site.country.name if @site.country}"
4 4
5 5
6 6 Current time at the server is
7 7 = "#{format_short_time(Time.new.gmtime)} UTC"
8 8 (please
9 9 = link_to 'refresh', :action => 'index'
10 10 to update)
11 11 %br/
12 12 %br/
13 13
14 - - form_tag :action => 'start' do
14 + = form_tag :action => 'start' do
15 15 When you're ready, you can click the button below to start the contest.
16 16 %br/
17 17 Please make sure that the contestants are ready.
18 18 After the contest is started, it <b>cannot</b> be paused or stopped.
19 19 %br/
20 20 = submit_tag 'Start the Contest.', :onclick => "return confirm('Are you sure?');"
21 21
22 22 %br/
23 23 %br/
24 24 = link_to '[log out]', :action => 'logout'
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -19,49 +19,49
19 19 submissionCount[<%= submission.problem_id %>]=<%= submission.number %>;
20 20 <% end %>
21 21
22 22 function updateSubmissionList() {
23 23 currentProb = document.getElementById("test_request_problem_id").value;
24 24 count = submissionCount[currentProb];
25 25 submissionSelect = document.getElementById("test_request_submission_number");
26 26 old_len = submissionSelect.length;
27 27 // clear the box
28 28 for(i=0; i<old_len; i++)
29 29 submissionSelect.remove(0);
30 30 for(i=count; i>=1; i--) {
31 31 try {
32 32 submissionSelect.add(new Option(""+i,""+i,false,false),null);
33 33 } catch(ex) {
34 34 submissionSelect.add(new Option(""+i,""+i,false,false));
35 35 }
36 36 }
37 37 }
38 38 </script>
39 39
40 40 <% if GraderConfiguration.show_submitbox_to?(@user) and GraderConfiguration.allow_test_request(@user) %>
41 41 <div class="submitbox">
42 42 <%= error_messages_for 'submitted_test_request' %>
43 - <% form_for :test_request, nil,
43 + <%= form_for :test_request, nil,
44 44 :url => { :action => 'submit'},
45 45 :html => { :multipart => true } do |f| %>
46 46 <table>
47 47 <tr>
48 48 <td>Task:</td>
49 49 <td>
50 50 <%= select(:test_request,
51 51 :problem_id,
52 52 @problems.collect {|p| [p.name, p.id]}, {},
53 53 { :onclick => "updateSubmissionList();" }) %>
54 54 </td>
55 55 </tr>
56 56 <tr>
57 57 <td>Submission:</td>
58 58 <td>
59 59 <%= select(:test_request,
60 60 :submission_number,
61 61 ((1..@submissions[0].number).collect {|n| [n,n]}).reverse) %>
62 62 </td>
63 63 </tr>
64 64 <tr>
65 65 <td>Input data:</td>
66 66 <td>
67 67 <%= f.file_field :input_file %>
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,25 +1,25
1 1 %h1 Administrators
2 2
3 3 %table{:class => 'info'}
4 4 %tr{:class => 'info-head'}
5 5 %th #
6 6 %th Login
7 7 %th Full name
8 8 %th
9 9 - @admins.each_with_index do |user, i|
10 10 %tr
11 11 %td= i+1
12 12 %td= user.login
13 13 %td= user.full_name
14 14 %td
15 15 - if user.login!='root'
16 16 = link_to '[revoke]', :action => 'revoke_admin', :id => user.id
17 17 %hr
18 18
19 - - form_tag :action => 'grant_admin' do
19 + = form_tag :action => 'grant_admin' do
20 20 Grant admin permission to:
21 21 = text_field_tag 'login'
22 22 = submit_tag 'Grant'
23 23
24 24 %hr/
25 25 = link_to '[go back to index]', :action => 'index'
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,26 +1,26
1 1 %h1 Bulk edit users in contests
2 2
3 - - form_tag :action => 'manage_contest' do
3 + = form_tag :action => 'manage_contest' do
4 4 List users' login below; one per line.
5 5 %br/
6 6 = text_area_tag 'login_list', nil, :rows => 23, :cols => 80
7 7 %br/
8 8 %table
9 9 %tr
10 10 %td{:valign => 'top'}
11 11 You want to
12 12 = select(nil,"operation",[['assign users to','assign'],['add users to','add'],['remove users from','remove']])
13 13 contest
14 14 = select("contest","id",Contest.all.collect {|c| [c.title, c.id]})
15 15 and also
16 16 %td
17 17 = check_box_tag 'reset_timer'
18 18 Auto-reset current contest timer.
19 19 %br/
20 20 = check_box_tag 'notification_emails'
21 21 Send notification email(s).
22 22
23 23 = submit_tag "Perform action!", :confirm => 'Are you sure?'
24 24
25 25 %hr/
26 26 = link_to '[go back to index]', :action => 'index'
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,19 +1,19
1 1 %h1 Send mass e-mails
2 2
3 - - form_tag :action => 'bulk_mail' do
3 + = form_tag :action => 'bulk_mail' do
4 4 %b List recipients' login below; one per line.
5 5 %br/
6 6 = text_area_tag 'login_list', nil, :rows => 7, :cols => 80
7 7 %br/
8 8 %b Subject:
9 9 = text_field_tag 'subject', '', :size => 60
10 10 %br/
11 11 %b Email body:
12 12 %br/
13 13 = text_area_tag 'email_body', nil, :rows => 11, :cols => 80
14 14 %br/
15 15
16 16 = submit_tag "Send mails", :confirm => 'Are you sure?'
17 17
18 18 %hr/
19 19 = link_to '[go back to index]', :action => 'index'
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,18 +1,18
1 1 .contest-title
2 2 %h1
3 3 = "#{GraderConfiguration['contest.name']}: #{t 'registration.password_retrieval.header'}"
4 4
5 5 - if flash[:notice]
6 6 %hr/
7 7 %b= flash[:notice]
8 8 %hr/
9 9
10 10 %br/
11 11
12 - - form_tag :action => 'retrieve_password' do
12 + = form_tag :action => 'retrieve_password' do
13 13 =t 'registration.password_retrieval.instructions'
14 14 = text_field 'email', nil, :size => 20
15 15 %br/
16 16 = submit_tag(t 'registration.password_retrieval.button_label')
17 17
18 18 = link_to "#{t 'go_back_to'}#{t 'home_page'}", :controller => 'main', :action => 'index'
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -3,36 +3,36
3 3
4 4 = user_title_bar(@user)
5 5
6 6 %h1 Your account settings
7 7
8 8 -#%p
9 9 -#You can edit your alias and e-mails. Just click on the text and edit it.
10 10
11 11 %table.uinfo
12 12 %tr
13 13 %th.uinfo Login
14 14 %td.uinfo= @user.login
15 15 %tr
16 16 %th.uinfo Full name
17 17 %td.uinfo= @user.full_name
18 18 -#%tr
19 19 -#%th.uinfo Alias
20 20 -#%td.uinfo= in_place_editor_field :user, 'alias_for_editing', {}, :rows => 1
21 21 -#%tr
22 22 -#%th.uinfo E-mail
23 23 -#%td.uinfo= in_place_editor_field :user, 'email_for_editing', {}, :rows => 1
24 24 %tr
25 25 %th.uinfo Password
26 26 %td.uinfo
27 - - form_tag :action => 'chg_passwd', :method => 'post' do
27 + = form_tag :action => 'chg_passwd', :method => 'post' do
28 28 %table
29 29 %tr
30 30 %td= password_field_tag 'passwd'
31 31 %td (new)
32 32 %tr
33 33 %td= password_field_tag 'passwd_verify'
34 34 %td (verify)
35 35 %tr
36 36 %td{:colspan => "2"}
37 37 = submit_tag 'change password'
38 38
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,35 +1,35
1 1 .contest-title
2 2 %h1
3 3 = "#{GraderConfiguration['contest.name']}: #{t 'registration.title'}"
4 4
5 5 .registration-desc
6 6 =t 'registration.description'
7 7
8 8 = error_messages_for :user, :header_message => (t 'registration.errors.header')
9 9
10 10 %table
11 - - form_for :user, @user, :url => { :action => 'register' } do |f|
11 + = form_for :user, @user, :url => { :action => 'register' } do |f|
12 12 %tr
13 13 %td{:align => "right"}
14 14 = "#{t 'login_label'}:"
15 15 %td= f.text_field :login
16 16 %tr
17 17 %td
18 18 %td
19 19 %small
20 20 =t 'registration.login_guide'
21 21 %tr
22 22 %td{:align => "right"}
23 23 = "#{t 'full_name_label'}:"
24 24 %td= f.text_field :full_name
25 25 %tr
26 26 %td{:align => "right"}
27 27 = "#{t 'email_label'}:"
28 28 %td= f.text_field :email
29 29 %tr
30 30 %td
31 31 %td
32 32 %small
33 33 =t 'registration.email_guide'
34 34 %tr
35 35 %td/
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -30,33 +30,33
30 30 config.time_zone = 'UTC'
31 31
32 32 # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
33 33 # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s]
34 34 config.i18n.default_locale = :en
35 35
36 36 # Configure the default encoding used in templates for Ruby 1.9.
37 37 config.encoding = "utf-8"
38 38
39 39 # Configure sensitive parameters which will be filtered from the log file.
40 40 config.filter_parameters += [:password]
41 41
42 42 # Enable escaping HTML in JSON.
43 43 config.active_support.escape_html_entities_in_json = true
44 44
45 45 # Use SQL instead of Active Record's schema dumper when creating the database.
46 46 # This is necessary if your schema can't be completely dumped by the schema dumper,
47 47 # like if you have constraints or database-specific column types
48 48 # config.active_record.schema_format = :sql
49 49
50 50 # Enforce whitelist mode for mass assignment.
51 51 # This will create an empty whitelist of attributes available for mass-assignment for all models
52 52 # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
53 53 # parameters by using an attr_accessible or attr_protected declaration.
54 - config.active_record.whitelist_attributes = true
54 + config.active_record.whitelist_attributes = false
55 55
56 56 # Enable the asset pipeline
57 57 config.assets.enabled = false
58 58
59 59 # Version of your assets, change this if you want to expire all your assets
60 60 config.assets.version = '1.0'
61 61 end
62 62 end
You need to be logged in to leave comments. Login now