cafe-grader-web Commit - r593:a1d7330b2f43

cafe-grader-web

Commit `r593:a1d7330b2f43` public

parent | child

Description:

- fix authorization for viewing submission, only admin can view all problems all the time, normal user depends on right.view_submission and problem.available? - add max score query

Commit status:

[Not Reviewed]

References:

java

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r593:a1d7330b2f43 - Wed, 28 Sep 2016 03:50:39 - 6 files changed: 106 inserted, 7 deleted

app/views/report/max_score.html.haml created 644 ¶ +43

@@ -0,0 +1,43
	1	+ %h1 Maximum score
	2	+
	3	+ = form_tag report_max_score_path
	4	+ .row
	5	+ .col-md-4
	6	+ .panel.panel-primary
	7	+ .panel-heading
	8	+ Problems
	9	+ .panel-body
	10	+ = label_tag :problems, "Problems"
	11	+ = select 'problems', 'problem_id', [[(t 'main.specified_in_header'),'-1']] + Problem.all.collect {\|p\| ["[#{p.name}] #{p.full_name}", p.id]}, {:selected => '-1'}, { class: 'select2 form-control' }
	12	+ .col-md-4
	13	+ .panel.panel-primary
	14	+ .panel-heading
	15	+ Submission range
	16	+ .panel-body
	17	+ .form-group
	18	+ = label_tag :from, "From"
	19	+ = text_field_tag 'from_id', nil, class: "form-control"
	20	+ .form-group
	21	+ = label_tag :from, "To"
	22	+ = text_field_tag 'to_id', nil, class: "form-control"
	23	+ .col-md-4
	24	+ .panel.panel-primary
	25	+ .panel-heading
	26	+ Users
	27	+ .panel-body
	28	+ .radio
	29	+ %label
	30	+ = radio_button_tag 'users', 'all', true
	31	+ All users
	32	+ .radio
	33	+ %label
	34	+ = radio_button_tag 'users', 'enabled'
	35	+ Only enabled users
	36	+ .row
	37	+ .col-md-12
	38	+ = button_tag 'Show', class: "btn btn-primary btn-large"
	39	+ = button_tag 'Download CSV', class: "btn btn-primary btn-large"
	40	+ /.col-md-4.col-md-offset-1
	41	+ / = button_tag 'Show', class: "btn btn-primary btn-block"
	42	+ /.col-md-4.col-md-offset-2
	43	+ / = button_tag 'Download CSV', class: "btn btn-primary btn-block"

.gitignore ¶ +4

               # See http://help.github.com/ignore-files/ for more about ignoring files.
               #
               # If you find yourself ignoring temporary files generated by your text editor
               # or operating system, you probably want to add a global ignore instead:
               #   git config --global core.excludesfile ~/.gitignore_global
               # Ignore bundler config
               /.bundle
               # Ignore the default SQLite database.
               /db/*.sqlite3
               # Ignore all logfiles and tempfiles.
               /log/*.log
               /tmp
               *~
               /vendor/plugins/rails_upgrade
               #ignore public assets???
               /public/assets
               /public
               /data
               #ignore .orig and .swp
               *.orig
               *.swp
+            +
+            + #ignore rvm setting file
+            + .ruby-gemset
+            + .ruby-version

app/controllers/application_controller.rb ¶ +8 -4

               class ApplicationController < ActionController::Base
                 protect_from_forgery
                 before_filter :current_user
                 SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode'
                 MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login'
+            +   #report and redirect for unauthorized activities
+            +   def unauthorized_redirect
+            +     flash[:notice] = 'You are not authorized to view the page you requested'
+            +     redirect_to :controller => 'main', :action => 'login'
+            +   end
+            +
                 # Returns the current logged-in user (if any).
                 def current_user
                   return nil unless session[:user_id]
                   @current_user ||= User.find(session[:user_id])
                 end
                 def admin_authorization
                   return false unless authenticate
                   user = User.find(session[:user_id], :include => ['roles'])
                   unless user.admin?
-            -       flash[:notice] = 'You are not authorized to view the page you requested'
+            +       unauthorized_redirect
-            -       redirect_to :controller => 'main', :action => 'login' unless user.admin?
                     return false
                   end
                   return true
                 end
                 def authorization_by_roles(allowed_roles)
                   return false unless authenticate
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role| allowed_roles.member?(role.name) }
-            -       flash[:notice] = 'You are not authorized to view the page you requested'
+            +       unauthorized_redirect
-            -       redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 protected
                 def authenticate
                   unless session[:user_id]
                     flash[:notice] = 'You need to login'
                     if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                       flash[:notice] = 'You need to login but you cannot log in at this time'
                     end
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                   # check if run in single user mode
                   if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                     user = User.find_by_id(session[:user_id])
                     if user==nil or (not user.admin?)
                       flash[:notice] = 'You cannot log in at this time'
                       redirect_to :controller => 'main', :action => 'login'
                       return false
                     end
                     unless user.enabled?
                       flash[:notice] = 'Your account is disabled'
                       redirect_to :controller => 'main', :action => 'login'
                       return false
                     end
                     return true
                   end
                   if GraderConfiguration.multicontests?
                     user = User.find(session[:user_id])
                     return true if user.admin?
                     begin
                       if user.contest_stat(true).forced_logout
                         flash[:notice] = 'You have been automatically logged out.'
                         redirect_to :controller => 'main', :action => 'index'
                       end
                     rescue
                     end
                   end
                   return true
                 end
                 def authenticate_by_ip_address
                   #this assume that we have already authenticate normally
                   unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
                     user = User.find(session[:user_id])
                     if (not user.admin? and user.last_ip and user.last_ip != request.remote_ip)
                       flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
                       redirect_to :controller => 'main', :action => 'login'
                       puts "CHEAT: user #{user.login} tried to login from '#{request.remote_ip}' while last ip is '#{user.last_ip}' at #{Time.zone.now}"
                       return false
                     end
                     unless user.last_ip
                       user.last_ip = request.remote_ip
                       user.save
                     end
                   end
                   return true
                 end
                 def authorization
                   return false unless authenticate
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role|
               	role.rights.detect{ |right|
               	  right.controller == self.class.controller_name and
                         (right.action == 'all' or right.action == action_name)
               	}
                     }
                     flash[:notice] = 'You are not authorized to view the page you requested'
                     #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 def verify_time_limit
                   return true if session[:user_id]==nil
                   user = User.find(session[:user_id], :include => :site)
                   return true if user==nil or user.site == nil
                   if user.contest_finished?
                     flash[:notice] = 'Error: the contest you are participating is over.'
                     redirect_to :back
                     return false
                   end
                   return true
                 end
               end

app/controllers/graders_controller.rb ¶ +10 -3

               class GradersController < ApplicationController
                 before_filter :admin_authorization, except: [ :submission ]
                 before_filter(only: [:submission]) {
+            +     #check if authenticated
                   return false unless authenticate
-            -     if GraderConfiguration["right.user_view_submission"]
+            +     #admin always has privileged
-            -       return true;
+            +     if @current_user.admin?
+            +       return true
                   end
-            -     admin_authorization
+            +     if GraderConfiguration["right.user_view_submission"] and Submission.find(params[:id]).problem.available?
+            +       return true
+            +     else
+            +       unauthorized_redirect
+            +       return false
+            +     end
                 }
                 verify :method => :post, :only => ['clear_all',
                                                    'start_exam',
                                                    'start_grading',
                                                    'stop_all',
                                                    'clear_terminated'],
                        :redirect_to => {:action => 'index'}
                 def index
                   redirect_to :action => 'list'
                 end
                 def list
                   @grader_processes = GraderProcess.find_running_graders
                   @stalled_processes = GraderProcess.find_stalled_process
                   @terminated_processes = GraderProcess.find_terminated_graders
                   @last_task = Task.find(:first,
                                          :order => 'created_at DESC')
                   @last_test_request = TestRequest.find(:first,
                                                         :order => 'created_at DESC')
                   @submission = Submission.order("id desc").limit(20)
                   @backlog_submission = Submission.where('graded_at is null')
                 end
                 def clear
                   grader_proc = GraderProcess.find(params[:id])
                   grader_proc.destroy if grader_proc!=nil
                   redirect_to :action => 'list'
                 end
                 def clear_terminated
                   GraderProcess.find_terminated_graders.each do |p|
                     p.destroy
                   end
                   redirect_to :action => 'list'
                 end
                 def clear_all
                   GraderProcess.find(:all).each do |p|
                     p.destroy
                   end
                   redirect_to :action => 'list'
                 end
                 def view
                   if params[:type]=='Task'
                     redirect_to :action => 'task', :id => params[:id]
                   else
                     redirect_to :action => 'test_request', :id => params[:id]
                   end
                 end
                 def test_request
                   @test_request = TestRequest.find(params[:id])
                 end
                 def task
                   @task = Task.find(params[:id])
                 end
                 def submission
                   @submission = Submission.find(params[:id])
                   formatter = Rouge::Formatters::HTML.new(css_class: 'highlight', line_numbers: true )
                   lexer = case @submission.language.name
                     when "c"      then Rouge::Lexers::C.new
                     when "cpp"    then Rouge::Lexers::Cpp.new
                     when "pas"    then Rouge::Lexers::Pas.new
                     when "ruby"   then Rouge::Lexers::Ruby.new
                     when "python" then Rouge::Lexers::Python.new
                     when "java"   then Rouge::Lexers::Java.new
                     when "php"    then Rouge::Lexers::PHP.new
                   end
                   @formatted_code = formatter.format(lexer.lex(@submission.source))
                   @css_style = Rouge::Themes::ThankfulEyes.render(scope: '.highlight')
                   user = User.find(session[:user_id])
                   SubmissionViewLog.create(user_id: session[:user_id],submission_id: @submission.id) unless user.admin?
                 end
                 # various grader controls
                 def stop
                   grader_proc = GraderProcess.find(params[:id])
                   GraderScript.stop_grader(grader_proc.pid)
                   flash[:notice] = 'Grader stopped.  It may not disappear now, but it should disappear shortly.'
                   redirect_to :action => 'list'
                 end
                 def stop_all
                   GraderScript.stop_graders(GraderProcess.find_running_graders +
                                             GraderProcess.find_stalled_process)
                   flash[:notice] = 'Graders stopped.  They may not disappear now, but they should disappear shortly.'

app/controllers/report_controller.rb ¶ +39

               class ReportController < ApplicationController
                 before_filter :admin_authorization, only: [:login_stat,:submission_stat, :stuck, :cheat_report, :cheat_scruntinize]
                 before_filter(only: [:problem_hof]) { |c|
                   return false unless authenticate
                   if GraderConfiguration["right.user_view_submission"]
                     return true;
                   end
                   admin_authorization
                 }
+            +   def show_max_score
+            +   end
+            +
+            +   def get_max_score
+            +     #process list of problems
+            +
+            +     #process submission range
+            +     if params[:commit] == 'download csv'
+            +       @problems = Problem.all
+            +     else
+            +       @problems = Problem.find_available_problems
+            +     end
+            +     @users = User.find(:all, :include => [:contests, :contest_stat])
+            +     @scorearray = Array.new
+            +     #set up range from param
+            +     since_id = params.fetch(:since_id, 0).to_i
+            +     until_id = params.fetch(:until_id, 0).to_i
+            +     @users.each do |u|
+            +       ustat = Array.new
+            +       ustat[0] = u
+            +       @problems.each do |p|
+            +         max_points = 0
+            +         Submission.find_in_range_by_user_and_problem(u.id,p.id,since_id,until_id).each do |sub|
+            +           max_points = sub.points if sub and sub.points and (sub.points > max_points)
+            +         end
+            +         ustat << [(max_points.to_f*100/p.full_score).round, (max_points>=p.full_score)]
+            +       end
+            +       @scorearray << ustat
+            +     end
+            +
+            +     if params[:commit] == 'download csv' then
+            +       csv = gen_csv_from_scorearray(@scorearray,@problems)
+            +       send_data csv, filename: 'max_score.csv'
+            +     else
+            +       render template: 'user_admin/user_stat'
+            +     end
+            +
+            +   end
+            +
                 def score
                   if params[:commit] == 'download csv'
                     @problems = Problem.all
                   else
                     @problems = Problem.find_available_problems
                   end
                   @users = User.includes(:contests, :contest_stat).where(enabled: true) #find(:all, :include => [:contests, :contest_stat]).where(enabled: true)
                   @scorearray = Array.new
                   @users.each do |u|
                     ustat = Array.new
                     ustat[0] = u
                     @problems.each do |p|
                       sub = Submission.find_last_by_user_and_problem(u.id,p.id)
                       if (sub!=nil) and (sub.points!=nil) and p and p.full_score
                         ustat << [(sub.points.to_f*100/p.full_score).round, (sub.points>=p.full_score)]
                       else
                         ustat << [0,false]
                       end
                     end
                     @scorearray << ustat
                   end
                   if params[:commit] == 'download csv' then
                     csv = gen_csv_from_scorearray(@scorearray,@problems)
                     send_data csv, filename: 'last_score.csv'
                   else
                     render template: 'user_admin/user_stat'
                   end
                 end
                 def login_stat
                   @logins = Array.new
                   date_and_time = '%Y-%m-%d %H:%M'
                   begin
                     md = params[:since_datetime].match(/(\d+)-(\d+)-(\d+) (\d+):(\d+)/)
                     @since_time = Time.zone.local(md[1].to_i,md[2].to_i,md[3].to_i,md[4].to_i,md[5].to_i)
                   rescue
                     @since_time = DateTime.new(1000,1,1)
                   end
                   begin
                     md = params[:until_datetime].match(/(\d+)-(\d+)-(\d+) (\d+):(\d+)/)
                     @until_time = Time.zone.local(md[1].to_i,md[2].to_i,md[3].to_i,md[4].to_i,md[5].to_i)
                   rescue
                     @until_time = DateTime.new(3000,1,1)
                   end
                   User.all.each do |user|
                     @logins << { id: user.id,
                                  login: user.login,
                                  full_name: user.full_name,
                                  count: Login.where("user_id = ? AND created_at >= ? AND created_at <= ?",
                                                     user.id,@since_time,@until_time)
                                         .count(:id),
                                  min: Login.where("user_id = ? AND created_at >= ? AND created_at <= ?",
                                                     user.id,@since_time,@until_time)
                                         .minimum(:created_at),
                                  max: Login.where("user_id = ? AND created_at >= ? AND created_at <= ?",
                                                     user.id,@since_time,@until_time)
                                         .maximum(:created_at),
                                   ip: Login.where("user_id = ? AND created_at >= ? AND created_at <= ?",
                                                     user.id,@since_time,@until_time)
                                         .select(:ip_address).uniq
                                }
                   end
                 end
                 def submission_stat
                   date_and_time = '%Y-%m-%d %H:%M'
                   begin
                     @since_time = DateTime.strptime(params[:since_datetime],date_and_time)
                   rescue
                     @since_time = DateTime.new(1000,1,1)
                   end
                   begin
                     @until_time = DateTime.strptime(params[:until_datetime],date_and_time)
                   rescue
                     @until_time = DateTime.new(3000,1,1)
                   end
                   @submissions = {}
                   User.find_each do |user|
                     @submissions[user.id] = { login: user.login, full_name: user.full_name, count: 0, sub: { } }
                   end
                   Submission.where("submitted_at >= ? AND submitted_at <= ?",@since_time,@until_time).find_each do |s|
                     if @submissions[s.user_id]
                       if not @submissions[s.user_id][:sub].has_key?(s.problem_id)
                         a = Problem.find_by_id(s.problem_id)
                         @submissions[s.user_id][:sub][s.problem_id] =
                           { prob_name: (a ? a.full_name : '(NULL)'),
                             sub_ids: [s.id] }
                       else

config/routes.rb ¶ +2

               CafeGrader::Application.routes.draw do
                 get "sources/direct_edit"
                 root :to => 'main#login'
                 resources :contests
                 resources :sites
                 resources :announcements do
                   member do
                     get 'toggle','toggle_front'
                   end
                 end
                 resources :problems do
                   member do
                     get 'toggle'
                     get 'toggle_test'
                   end
                   collection do
                     get 'turn_all_off'
                     get 'turn_all_on'
                     get 'import'
                     get 'manage'
                   end
                 end
                 resources :grader_configuration, controller: 'configurations'
                 resources :users do
                   member do
                     get 'toggle_activate', 'toggle_enable'
                   end
                 end
                 #source code edit
                 get 'sources/direct_edit/:pid', to: 'sources#direct_edit', as: 'direct_edit'
                 get 'sources/direct_edit_submission/:sid', to: 'sources#direct_edit_submission', as: 'direct_edit_submission'
                 get 'sources/get_latest_submission_status/:uid/:pid', to: 'sources#get_latest_submission_status', as: 'get_latest_submission_status'
                 match 'tasks/view/:file.:ext' => 'tasks#view'
                 match 'tasks/download/:id/:file.:ext' => 'tasks#download'
                 match 'heartbeat/:id/edit' => 'heartbeat#edit'
                 #main
                 get "main/list"
                 get 'main/submission(/:id)', to: 'main#submission', as: 'main_submission'
                 #report
                 get 'report/problem_hof(/:id)', to: 'report#problem_hof', as: 'report_problem_hof'
                 get "report/login"
+            +   get 'report/max_score', to: 'report#max_score', as: 'report_max_score'
                 #grader
                 get 'graders/list', to: 'graders#list', as: 'grader_list'
+            +
                 match 'heartbeat/:id/edit' => 'heartbeat#edit'
                 # See how all your routes lay out with "rake routes"
                 # This is a legacy wild controller route that's not recommended for RESTful applications.
                 # Note: This route will make all actions in every controller accessible via GET requests.
                 match ':controller(/:action(/:id))(.:format)'
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r593:a1d7330b2f43 - Wed, 28 Sep 2016 03:50:39 - 6 files changed: 106 inserted, 7 deleted

Sign in to your account

Commit r593:a1d7330b2f43 public

Author

r593:a1d7330b2f43 - Wed, 28 Sep 2016 03:50:39 - 6 files changed: 106 inserted, 7 deleted

Commit `r593:a1d7330b2f43` public