Description:
fixed form_tag/form_for, disabled attributes whitelist
Commit status:
[Not Reviewed]
References:
Diff options:
Comments:
0 Commit comments
0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
r321:6490fd9a1f54 - - 17 files changed: 23 inserted, 22 deleted
@@ -55,13 +55,14 | |||
|
55 | 55 | @user = User.find(session[:user_id]) |
|
56 | 56 | end |
|
57 | 57 | |
|
58 | 58 | def submit |
|
59 | 59 | user = User.find(session[:user_id]) |
|
60 | 60 | |
|
61 |
- @submission = Submission.new |
|
|
61 | + @submission = Submission.new | |
|
62 | + @submission.problem_id = params[:submission][:problem_id] | |
|
62 | 63 | @submission.user = user |
|
63 | 64 | @submission.language_id = 0 |
|
64 | 65 | if (params['file']) and (params['file']!='') |
|
65 | 66 | @submission.source = params['file'].read |
|
66 | 67 | @submission.source_filename = params['file'].original_filename |
|
67 | 68 | end |
@@ -8,22 +8,22 | |||
|
8 | 8 | %br/ |
|
9 | 9 | |
|
10 | 10 | .submitbox |
|
11 | 11 | .item |
|
12 | 12 | Grader control: |
|
13 | 13 | .item |
|
14 |
- |
|
|
14 | + = form_for :clear, nil, :url => {:action => 'start_grading'} do |f| | |
|
15 | 15 | = submit_tag 'Start graders in grading env' |
|
16 | 16 | .item |
|
17 |
- |
|
|
17 | + = form_for :clear, nil, :url => {:action => 'start_exam'} do |f| | |
|
18 | 18 | = submit_tag 'Start graders in exam env' |
|
19 | 19 | .item |
|
20 |
- |
|
|
20 | + = form_for :clear, nil, :url => {:action => 'stop_all'} do |f| | |
|
21 | 21 | = submit_tag 'Stop all running graders' |
|
22 | 22 | .item |
|
23 |
- |
|
|
23 | + = form_for :clear, nil, :url => {:action => 'clear_all'} do |f| | |
|
24 | 24 | = submit_tag 'Clear all data' |
|
25 | 25 | %br{:style => 'clear:both'}/ |
|
26 | 26 | |
|
27 | 27 | - if @last_task |
|
28 | 28 | Last task: |
|
29 | 29 | = link_to "#{@last_task.id}", :action => 'view', :id => @last_task.id, :type => 'Task' |
@@ -42,10 +42,10 | |||
|
42 | 42 | %h2 Stalled graders |
|
43 | 43 | |
|
44 | 44 | = render :partial => 'grader_list', :locals => {:grader_list => @stalled_processes} |
|
45 | 45 | |
|
46 | 46 | %h2 Terminated graders |
|
47 | 47 | |
|
48 |
- |
|
|
48 | + = form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f| | |
|
49 | 49 | = submit_tag 'Clear data for terminated graders' |
|
50 | 50 | |
|
51 | 51 | = render :partial => 'grader_list', :locals => {:grader_list => @terminated_processes} |
@@ -9,8 +9,8 | |||
|
9 | 9 | - @contests.each do |contest| |
|
10 | 10 | = contest.title |
|
11 | 11 | %br |
|
12 | 12 | |
|
13 | 13 | =t 'main.confirm_contest_start.timer_starts_after_click' |
|
14 | 14 | |
|
15 |
- |
|
|
15 | + = form_tag :action => 'confirm_contest_start', :method => 'post' do | |
|
16 | 16 | = submit_tag t('main.confirm_contest_start.start_button'), :confirm => t('main.confirm_contest_start.start_button_confirm') |
@@ -11,13 +11,13 | |||
|
11 | 11 | (1) **YES**, |
|
12 | 12 | (2) <b>NO</b>, |
|
13 | 13 | (3) **ANSWERED IN TASK DESCRIPTION (EXPLICITLY OR IMPLICITLY)**, |
|
14 | 14 | (4) **INVALID QUESTION**, and |
|
15 | 15 | (5) **NO COMMENT**. |
|
16 | 16 | |
|
17 |
- |
|
|
17 | + = form_for 'message', nil, :url => { :action => 'create'} do |f| | |
|
18 | 18 | %p |
|
19 | 19 | %b New clarification request |
|
20 | 20 | = submit_tag "Post" |
|
21 | 21 | %br/ |
|
22 | 22 | = f.text_area :body, :rows => 5, :cols => 100 |
|
23 | 23 |
@@ -3,13 +3,13 | |||
|
3 | 3 | .message |
|
4 | 4 | .stat |
|
5 | 5 | = "#{@message.sender.full_name} at #{@message.created_at}" |
|
6 | 6 | .body= simple_format(@message.body) |
|
7 | 7 | |
|
8 | 8 | %h3 Your reply: |
|
9 |
- |
|
|
9 | + = form_for 'r_message', nil, :url => { :action => 'reply'} do |f| | |
|
10 | 10 | = f.text_area :body, :rows => 5, :cols => 100 |
|
11 | 11 | = f.hidden_field :receiver_id, {:value => @message.sender_id } |
|
12 | 12 | = f.hidden_field :replying_message_id, {:value => @message.id } |
|
13 | 13 | = submit_tag "Post" |
|
14 | 14 | |
|
15 | 15 | %p |
@@ -6,13 +6,13 | |||
|
6 | 6 | |
|
7 | 7 | %p= link_to '[Back to problem list]', :action => 'list' |
|
8 | 8 | |
|
9 | 9 | - if @problem and @problem.errors |
|
10 | 10 | =error_messages_for 'problem' |
|
11 | 11 | |
|
12 |
- |
|
|
12 | + = form_tag({:action => 'do_import'}, :multipart => true) do | |
|
13 | 13 | .submitbox |
|
14 | 14 | %table |
|
15 | 15 | %tr |
|
16 | 16 | %td Name: |
|
17 | 17 | %td= text_field_tag 'name' |
|
18 | 18 | %tr |
@@ -3,13 +3,13 | |||
|
3 | 3 | = javascript_include_tag :defaults |
|
4 | 4 | |
|
5 | 5 | %h1 Manage problems |
|
6 | 6 | |
|
7 | 7 | %p= link_to '[Back to problem list]', :action => 'list' |
|
8 | 8 | |
|
9 |
- |
|
|
9 | + = form_tag :action=>'do_manage' do | |
|
10 | 10 | .submitbox |
|
11 | 11 | What do you want to do? |
|
12 | 12 | %br/ |
|
13 | 13 | %ul |
|
14 | 14 | %li |
|
15 | 15 | Change date added to |
@@ -12,23 +12,23 | |||
|
12 | 12 | %script{:type => 'text/javascript', :src => '/javascripts/site_update.js'} |
|
13 | 13 | |
|
14 | 14 | %div{ :style => "border: solid 1px gray; padding: 2px; background: #f0f0f0;"} |
|
15 | 15 | %h2 For Site Administrator. |
|
16 | 16 | |
|
17 | 17 | - if @default_site |
|
18 |
- |
|
|
18 | + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f| | |
|
19 | 19 | %b Log in for default site. |
|
20 | 20 | = f.hidden_field :site_id, :value => @default_site.id |
|
21 | 21 | %br/ |
|
22 | 22 | Password: |
|
23 | 23 | = f.password_field :password |
|
24 | 24 | = submit_tag "Site Administrator Login" |
|
25 | 25 | |
|
26 | 26 | - else |
|
27 | 27 | Please select your country and site and login. |
|
28 |
- |
|
|
28 | + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f| | |
|
29 | 29 | Country: |
|
30 | 30 | = select :site_country, :id, @country_select_with_all, {}, {:onchange => "updateSiteList();", :onclick => "updateSiteList();" } |
|
31 | 31 | Site: |
|
32 | 32 | = select :login, :site_id, @site_select |
|
33 | 33 | %br/ |
|
34 | 34 | Password: |
@@ -8,13 +8,13 | |||
|
8 | 8 | (please |
|
9 | 9 | = link_to 'refresh', :action => 'index' |
|
10 | 10 | to update) |
|
11 | 11 | %br/ |
|
12 | 12 | %br/ |
|
13 | 13 | |
|
14 |
- |
|
|
14 | + = form_tag :action => 'start' do | |
|
15 | 15 | When you're ready, you can click the button below to start the contest. |
|
16 | 16 | %br/ |
|
17 | 17 | Please make sure that the contestants are ready. |
|
18 | 18 | After the contest is started, it <b>cannot</b> be paused or stopped. |
|
19 | 19 | %br/ |
|
20 | 20 | = submit_tag 'Start the Contest.', :onclick => "return confirm('Are you sure?');" |
@@ -37,13 +37,13 | |||
|
37 | 37 | } |
|
38 | 38 | </script> |
|
39 | 39 | |
|
40 | 40 | <% if GraderConfiguration.show_submitbox_to?(@user) and GraderConfiguration.allow_test_request(@user) %> |
|
41 | 41 | <div class="submitbox"> |
|
42 | 42 | <%= error_messages_for 'submitted_test_request' %> |
|
43 | - <% form_for :test_request, nil, | |
|
43 | + <%= form_for :test_request, nil, | |
|
44 | 44 | :url => { :action => 'submit'}, |
|
45 | 45 | :html => { :multipart => true } do |f| %> |
|
46 | 46 | <table> |
|
47 | 47 | <tr> |
|
48 | 48 | <td>Task:</td> |
|
49 | 49 | <td> |
@@ -13,13 +13,13 | |||
|
13 | 13 | %td= user.full_name |
|
14 | 14 | %td |
|
15 | 15 | - if user.login!='root' |
|
16 | 16 | = link_to '[revoke]', :action => 'revoke_admin', :id => user.id |
|
17 | 17 | %hr |
|
18 | 18 | |
|
19 |
- |
|
|
19 | + = form_tag :action => 'grant_admin' do | |
|
20 | 20 | Grant admin permission to: |
|
21 | 21 | = text_field_tag 'login' |
|
22 | 22 | = submit_tag 'Grant' |
|
23 | 23 | |
|
24 | 24 | %hr/ |
|
25 | 25 | = link_to '[go back to index]', :action => 'index' |
@@ -1,9 +1,9 | |||
|
1 | 1 | %h1 Bulk edit users in contests |
|
2 | 2 | |
|
3 |
- |
|
|
3 | + = form_tag :action => 'manage_contest' do | |
|
4 | 4 | List users' login below; one per line. |
|
5 | 5 | %br/ |
|
6 | 6 | = text_area_tag 'login_list', nil, :rows => 23, :cols => 80 |
|
7 | 7 | %br/ |
|
8 | 8 | %table |
|
9 | 9 | %tr |
@@ -1,9 +1,9 | |||
|
1 | 1 | %h1 Send mass e-mails |
|
2 | 2 | |
|
3 |
- |
|
|
3 | + = form_tag :action => 'bulk_mail' do | |
|
4 | 4 | %b List recipients' login below; one per line. |
|
5 | 5 | %br/ |
|
6 | 6 | = text_area_tag 'login_list', nil, :rows => 7, :cols => 80 |
|
7 | 7 | %br/ |
|
8 | 8 | %b Subject: |
|
9 | 9 | = text_field_tag 'subject', '', :size => 60 |
@@ -6,13 +6,13 | |||
|
6 | 6 | %hr/ |
|
7 | 7 | %b= flash[:notice] |
|
8 | 8 | %hr/ |
|
9 | 9 | |
|
10 | 10 | %br/ |
|
11 | 11 | |
|
12 |
- |
|
|
12 | + = form_tag :action => 'retrieve_password' do | |
|
13 | 13 | =t 'registration.password_retrieval.instructions' |
|
14 | 14 | = text_field 'email', nil, :size => 20 |
|
15 | 15 | %br/ |
|
16 | 16 | = submit_tag(t 'registration.password_retrieval.button_label') |
|
17 | 17 | |
|
18 | 18 | = link_to "#{t 'go_back_to'}#{t 'home_page'}", :controller => 'main', :action => 'index' |
@@ -21,13 +21,13 | |||
|
21 | 21 | -#%tr |
|
22 | 22 | -#%th.uinfo E-mail |
|
23 | 23 | -#%td.uinfo= in_place_editor_field :user, 'email_for_editing', {}, :rows => 1 |
|
24 | 24 | %tr |
|
25 | 25 | %th.uinfo Password |
|
26 | 26 | %td.uinfo |
|
27 |
- |
|
|
27 | + = form_tag :action => 'chg_passwd', :method => 'post' do | |
|
28 | 28 | %table |
|
29 | 29 | %tr |
|
30 | 30 | %td= password_field_tag 'passwd' |
|
31 | 31 | %td (new) |
|
32 | 32 | %tr |
|
33 | 33 | %td= password_field_tag 'passwd_verify' |
@@ -5,13 +5,13 | |||
|
5 | 5 | .registration-desc |
|
6 | 6 | =t 'registration.description' |
|
7 | 7 | |
|
8 | 8 | = error_messages_for :user, :header_message => (t 'registration.errors.header') |
|
9 | 9 | |
|
10 | 10 | %table |
|
11 |
- |
|
|
11 | + = form_for :user, @user, :url => { :action => 'register' } do |f| | |
|
12 | 12 | %tr |
|
13 | 13 | %td{:align => "right"} |
|
14 | 14 | = "#{t 'login_label'}:" |
|
15 | 15 | %td= f.text_field :login |
|
16 | 16 | %tr |
|
17 | 17 | %td |
@@ -48,13 +48,13 | |||
|
48 | 48 | # config.active_record.schema_format = :sql |
|
49 | 49 | |
|
50 | 50 | # Enforce whitelist mode for mass assignment. |
|
51 | 51 | # This will create an empty whitelist of attributes available for mass-assignment for all models |
|
52 | 52 | # in your app. As such, your models will need to explicitly whitelist or blacklist accessible |
|
53 | 53 | # parameters by using an attr_accessible or attr_protected declaration. |
|
54 |
- config.active_record.whitelist_attributes = |
|
|
54 | + config.active_record.whitelist_attributes = false | |
|
55 | 55 | |
|
56 | 56 | # Enable the asset pipeline |
|
57 | 57 | config.assets.enabled = false |
|
58 | 58 | |
|
59 | 59 | # Version of your assets, change this if you want to expire all your assets |
|
60 | 60 | config.assets.version = '1.0' |
You need to be logged in to leave comments.
Login now