Description:
fixed form_tag/form_for, disabled attributes whitelist
Commit status:
[Not Reviewed]
References:
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Add another comment

r321:6490fd9a1f54 - - 17 files changed: 23 inserted, 22 deleted

@@ -55,13 +55,14
55 55 @user = User.find(session[:user_id])
56 56 end
57 57
58 58 def submit
59 59 user = User.find(session[:user_id])
60 60
61 - @submission = Submission.new(params[:submission])
61 + @submission = Submission.new
62 + @submission.problem_id = params[:submission][:problem_id]
62 63 @submission.user = user
63 64 @submission.language_id = 0
64 65 if (params['file']) and (params['file']!='')
65 66 @submission.source = params['file'].read
66 67 @submission.source_filename = params['file'].original_filename
67 68 end
@@ -8,22 +8,22
8 8 %br/
9 9
10 10 .submitbox
11 11 .item
12 12 Grader control:
13 13 .item
14 - - form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
14 + = form_for :clear, nil, :url => {:action => 'start_grading'} do |f|
15 15 = submit_tag 'Start graders in grading env'
16 16 .item
17 - - form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
17 + = form_for :clear, nil, :url => {:action => 'start_exam'} do |f|
18 18 = submit_tag 'Start graders in exam env'
19 19 .item
20 - - form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
20 + = form_for :clear, nil, :url => {:action => 'stop_all'} do |f|
21 21 = submit_tag 'Stop all running graders'
22 22 .item
23 - - form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
23 + = form_for :clear, nil, :url => {:action => 'clear_all'} do |f|
24 24 = submit_tag 'Clear all data'
25 25 %br{:style => 'clear:both'}/
26 26
27 27 - if @last_task
28 28 Last task:
29 29 = link_to "#{@last_task.id}", :action => 'view', :id => @last_task.id, :type => 'Task'
@@ -42,10 +42,10
42 42 %h2 Stalled graders
43 43
44 44 = render :partial => 'grader_list', :locals => {:grader_list => @stalled_processes}
45 45
46 46 %h2 Terminated graders
47 47
48 - - form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
48 + = form_for :clear, nil, :url => {:action => 'clear_terminated'} do |f|
49 49 = submit_tag 'Clear data for terminated graders'
50 50
51 51 = render :partial => 'grader_list', :locals => {:grader_list => @terminated_processes}
@@ -9,8 +9,8
9 9 - @contests.each do |contest|
10 10 = contest.title
11 11 %br
12 12
13 13 =t 'main.confirm_contest_start.timer_starts_after_click'
14 14
15 - - form_tag :action => 'confirm_contest_start', :method => 'post' do
15 + = form_tag :action => 'confirm_contest_start', :method => 'post' do
16 16 = submit_tag t('main.confirm_contest_start.start_button'), :confirm => t('main.confirm_contest_start.start_button_confirm')
@@ -11,13 +11,13
11 11 (1) **YES**,
12 12 (2) <b>NO</b>,
13 13 (3) **ANSWERED IN TASK DESCRIPTION (EXPLICITLY OR IMPLICITLY)**,
14 14 (4) **INVALID QUESTION**, and
15 15 (5) **NO COMMENT**.
16 16
17 - - form_for 'message', nil, :url => { :action => 'create'} do |f|
17 + = form_for 'message', nil, :url => { :action => 'create'} do |f|
18 18 %p
19 19 %b New clarification request
20 20 = submit_tag "Post"
21 21 %br/
22 22 = f.text_area :body, :rows => 5, :cols => 100
23 23
@@ -3,13 +3,13
3 3 .message
4 4 .stat
5 5 = "#{@message.sender.full_name} at #{@message.created_at}"
6 6 .body= simple_format(@message.body)
7 7
8 8 %h3 Your reply:
9 - - form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
9 + = form_for 'r_message', nil, :url => { :action => 'reply'} do |f|
10 10 = f.text_area :body, :rows => 5, :cols => 100
11 11 = f.hidden_field :receiver_id, {:value => @message.sender_id }
12 12 = f.hidden_field :replying_message_id, {:value => @message.id }
13 13 = submit_tag "Post"
14 14
15 15 %p
@@ -6,13 +6,13
6 6
7 7 %p= link_to '[Back to problem list]', :action => 'list'
8 8
9 9 - if @problem and @problem.errors
10 10 =error_messages_for 'problem'
11 11
12 - - form_tag({:action => 'do_import'}, :multipart => true) do
12 + = form_tag({:action => 'do_import'}, :multipart => true) do
13 13 .submitbox
14 14 %table
15 15 %tr
16 16 %td Name:
17 17 %td= text_field_tag 'name'
18 18 %tr
@@ -3,13 +3,13
3 3 = javascript_include_tag :defaults
4 4
5 5 %h1 Manage problems
6 6
7 7 %p= link_to '[Back to problem list]', :action => 'list'
8 8
9 - - form_tag :action=>'do_manage' do
9 + = form_tag :action=>'do_manage' do
10 10 .submitbox
11 11 What do you want to do?
12 12 %br/
13 13 %ul
14 14 %li
15 15 Change date added to
@@ -12,23 +12,23
12 12 %script{:type => 'text/javascript', :src => '/javascripts/site_update.js'}
13 13
14 14 %div{ :style => "border: solid 1px gray; padding: 2px; background: #f0f0f0;"}
15 15 %h2 For Site Administrator.
16 16
17 17 - if @default_site
18 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
18 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
19 19 %b Log in for default site.
20 20 = f.hidden_field :site_id, :value => @default_site.id
21 21 %br/
22 22 Password:
23 23 = f.password_field :password
24 24 = submit_tag "Site Administrator Login"
25 25
26 26 - else
27 27 Please select your country and site and login.
28 - - form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
28 + = form_for :login, nil, :url => {:controller => 'login', :action => 'site_login'} do |f|
29 29 Country:
30 30 = select :site_country, :id, @country_select_with_all, {}, {:onchange => "updateSiteList();", :onclick => "updateSiteList();" }
31 31 Site:
32 32 = select :login, :site_id, @site_select
33 33 %br/
34 34 Password:
@@ -8,13 +8,13
8 8 (please
9 9 = link_to 'refresh', :action => 'index'
10 10 to update)
11 11 %br/
12 12 %br/
13 13
14 - - form_tag :action => 'start' do
14 + = form_tag :action => 'start' do
15 15 When you're ready, you can click the button below to start the contest.
16 16 %br/
17 17 Please make sure that the contestants are ready.
18 18 After the contest is started, it <b>cannot</b> be paused or stopped.
19 19 %br/
20 20 = submit_tag 'Start the Contest.', :onclick => "return confirm('Are you sure?');"
@@ -37,13 +37,13
37 37 }
38 38 </script>
39 39
40 40 <% if GraderConfiguration.show_submitbox_to?(@user) and GraderConfiguration.allow_test_request(@user) %>
41 41 <div class="submitbox">
42 42 <%= error_messages_for 'submitted_test_request' %>
43 - <% form_for :test_request, nil,
43 + <%= form_for :test_request, nil,
44 44 :url => { :action => 'submit'},
45 45 :html => { :multipart => true } do |f| %>
46 46 <table>
47 47 <tr>
48 48 <td>Task:</td>
49 49 <td>
@@ -13,13 +13,13
13 13 %td= user.full_name
14 14 %td
15 15 - if user.login!='root'
16 16 = link_to '[revoke]', :action => 'revoke_admin', :id => user.id
17 17 %hr
18 18
19 - - form_tag :action => 'grant_admin' do
19 + = form_tag :action => 'grant_admin' do
20 20 Grant admin permission to:
21 21 = text_field_tag 'login'
22 22 = submit_tag 'Grant'
23 23
24 24 %hr/
25 25 = link_to '[go back to index]', :action => 'index'
@@ -1,9 +1,9
1 1 %h1 Bulk edit users in contests
2 2
3 - - form_tag :action => 'manage_contest' do
3 + = form_tag :action => 'manage_contest' do
4 4 List users' login below; one per line.
5 5 %br/
6 6 = text_area_tag 'login_list', nil, :rows => 23, :cols => 80
7 7 %br/
8 8 %table
9 9 %tr
@@ -1,9 +1,9
1 1 %h1 Send mass e-mails
2 2
3 - - form_tag :action => 'bulk_mail' do
3 + = form_tag :action => 'bulk_mail' do
4 4 %b List recipients' login below; one per line.
5 5 %br/
6 6 = text_area_tag 'login_list', nil, :rows => 7, :cols => 80
7 7 %br/
8 8 %b Subject:
9 9 = text_field_tag 'subject', '', :size => 60
@@ -6,13 +6,13
6 6 %hr/
7 7 %b= flash[:notice]
8 8 %hr/
9 9
10 10 %br/
11 11
12 - - form_tag :action => 'retrieve_password' do
12 + = form_tag :action => 'retrieve_password' do
13 13 =t 'registration.password_retrieval.instructions'
14 14 = text_field 'email', nil, :size => 20
15 15 %br/
16 16 = submit_tag(t 'registration.password_retrieval.button_label')
17 17
18 18 = link_to "#{t 'go_back_to'}#{t 'home_page'}", :controller => 'main', :action => 'index'
@@ -21,13 +21,13
21 21 -#%tr
22 22 -#%th.uinfo E-mail
23 23 -#%td.uinfo= in_place_editor_field :user, 'email_for_editing', {}, :rows => 1
24 24 %tr
25 25 %th.uinfo Password
26 26 %td.uinfo
27 - - form_tag :action => 'chg_passwd', :method => 'post' do
27 + = form_tag :action => 'chg_passwd', :method => 'post' do
28 28 %table
29 29 %tr
30 30 %td= password_field_tag 'passwd'
31 31 %td (new)
32 32 %tr
33 33 %td= password_field_tag 'passwd_verify'
@@ -5,13 +5,13
5 5 .registration-desc
6 6 =t 'registration.description'
7 7
8 8 = error_messages_for :user, :header_message => (t 'registration.errors.header')
9 9
10 10 %table
11 - - form_for :user, @user, :url => { :action => 'register' } do |f|
11 + = form_for :user, @user, :url => { :action => 'register' } do |f|
12 12 %tr
13 13 %td{:align => "right"}
14 14 = "#{t 'login_label'}:"
15 15 %td= f.text_field :login
16 16 %tr
17 17 %td
@@ -48,13 +48,13
48 48 # config.active_record.schema_format = :sql
49 49
50 50 # Enforce whitelist mode for mass assignment.
51 51 # This will create an empty whitelist of attributes available for mass-assignment for all models
52 52 # in your app. As such, your models will need to explicitly whitelist or blacklist accessible
53 53 # parameters by using an attr_accessible or attr_protected declaration.
54 - config.active_record.whitelist_attributes = true
54 + config.active_record.whitelist_attributes = false
55 55
56 56 # Enable the asset pipeline
57 57 config.assets.enabled = false
58 58
59 59 # Version of your assets, change this if you want to expire all your assets
60 60 config.assets.version = '1.0'
You need to be logged in to leave comments. Login now