cafe-grader-web Commit - r683:d4ac431eeeb6

cafe-grader-web

Commit `r683:d4ac431eeeb6` public

parent | child

Description:

fix access right control bugs

Commit status:

[Not Reviewed]

References:

java

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r683:d4ac431eeeb6 - Sun, 17 Sep 2017 08:17:08 - 2 files changed: 9 inserted, 7 deleted

app/controllers/submissions_controller.rb ¶ +8 -6

               class SubmissionsController < ApplicationController
                 before_action :authenticate
-            -   before_action :submission_authorization, only: [:show, :direct_edit_submission, :download, :edit]
+            +   before_action :submission_authorization, only: [:show, :download, :edit]
                 before_action :admin_authorization, only: [:rejudge]
                 # GET /submissions
                 # GET /submissions.json
                 # Show problem selection and user's submission of that problem
                 def index
                   @user = @current_user
                   @problems = @user.available_problems
                   if params[:problem_id]==nil
                     @problem = nil
                     @submissions = nil
                   else
                     @problem = Problem.find_by_id(params[:problem_id])
                     if (@problem == nil) or (not @problem.available)
                       redirect_to main_list_path
                       flash[:notice] = 'Error: submissions for that problem are not viewable.'
                       return
                     end
                     @submissions = Submission.find_all_by_user_problem(@user.id, @problem.id).order(id: :desc)
                   end
                 end
                 # GET /submissions/1
                 # GET /submissions/1.json
                 def show
                   @submission = Submission.find(params[:id])
                   #log the viewing
                   user = User.find(session[:user_id])
                   SubmissionViewLog.create(user_id: session[:user_id],submission_id: @submission.id) unless user.admin?
                   @task = @submission.task
                 end
                 def download
                   @submission = Submission.find(params[:id])
                   send_data(@submission.source, {:filename => @submission.download_filename, :type => 'text/plain'})
                 end
                 def compiler_msg
                   @submission = Submission.find(params[:id])
                   respond_to do |format|
                     format.js
                   end
                 end
                 #on-site new submission on specific problem
                 def direct_edit_problem
                   @problem = Problem.find(params[:problem_id])
+            +     unless @current_user.can_view_problem?(@problem)
+            +       unauthorized_redirect
+            +       return
+            +     end
                   @source = ''
-            -     if (params[:user_id])
+            +     if (params[:view_latest])
-            -       u = User.find(params[:user_id])
+            +       sub = Submission.find_last_by_user_and_problem(@current_user.id,@problem.id)
-            -       @submission = Submission.find_last_by_user_and_problem(u.id,@problem.id)
                     @source = @submission.source.to_s if @submission and @submission.source
                   end
                   render 'edit'
                 end
                 # GET /submissions/1/edit
                 def edit
                   @submission = Submission.find(params[:id])
                   @source = @submission.source.to_s
                   @problem = @submission.problem
                   @lang_id = @submission.language.id
                 end
                 def get_latest_submission_status
                   @problem = Problem.find(params[:pid])
                   @submission = Submission.find_last_by_user_and_problem(params[:uid],params[:pid])
                   puts User.find(params[:uid]).login
                   puts Problem.find(params[:pid]).name
                   puts 'nil' unless @submission
                   respond_to do |format|
                     format.js
                   end
                 end
                 # GET /submissions/:id/rejudge
                 def rejudge
                   @submission = Submission.find(params[:id])
                   @task = @submission.task
                   @task.status_inqueue! if @task
                   respond_to do |format|
                     format.js
                   end
                 end
               protected
                 def submission_authorization
                   #admin always has privileged
                   if @current_user.admin?
                     return true
                   end
                   sub = Submission.find(params[:id])
-            -     if sub.problem.available?
+            +     if @current_user.available_problems.include? sub.problem
-            -       puts "sub = #{sub.user.id}, current = #{@current_user.id}"
                     return true if GraderConfiguration["right.user_view_submission"] or sub.user == @current_user
                   end
                   #default to NO
                   unauthorized_redirect
                   return false
                 end
               end

app/models/submission.rb ¶ +1 -1

               class Submission < ActiveRecord::Base
                 belongs_to :language
                 belongs_to :problem
                 belongs_to :user
                 before_validation :assign_problem
                 before_validation :assign_language
                 validates_presence_of :source
                 validates_length_of :source, :maximum => 100_000, :allow_blank => true, :message => 'too long'
                 validates_length_of :source, :minimum => 1, :allow_blank => true, :message => 'too short'
                 validate :must_have_valid_problem
                 validate :must_specify_language
                 has_one :task
                 before_save :assign_latest_number_if_new_recond
                 def self.find_last_by_user_and_problem(user_id, problem_id)
                   where("user_id = ? AND problem_id = ?",user_id,problem_id).last
                 end
                 def self.find_all_last_by_problem(problem_id)
                   # need to put in SQL command, maybe there's a better way
                   Submission.includes(:user).find_by_sql("SELECT * FROM submissions " +
               			   "WHERE id = " +
               			   "(SELECT MAX(id) FROM submissions AS subs " +
               			   "WHERE subs.user_id = submissions.user_id AND " +
                                          "problem_id = " + problem_id.to_s + " " +
               			   "GROUP BY user_id) " +
                                          "ORDER BY user_id")
                 end
                 def self.find_in_range_by_user_and_problem(user_id, problem_id,since_id,until_id)
                   records = Submission.where(problem_id: problem_id,user_id: user_id)
                   records = records.where('id >= ?',since_id) if since_id > 0
                   records = records.where('id <= ?',until_id) if until_id > 0
                   records.all
                 end
                 def self.find_last_for_all_available_problems(user_id)
                   submissions = Array.new
                   problems = Problem.available_problems
                   problems.each do |problem|
                     sub = Submission.find_last_by_user_and_problem(user_id, problem.id)
                     submissions << sub if sub!=nil
                   end
                   submissions
                 end
                 def self.find_by_user_problem_number(user_id, problem_id, number)
                   where("user_id = ? AND problem_id = ? AND number = ?",user_id,problem_id,number).first
                 end
                 def self.find_all_by_user_problem(user_id, problem_id)
                   where("user_id = ? AND problem_id = ?",user_id,problem_id)
                 end
                 def download_filename
                   if self.problem.output_only
                     return self.source_filename
                   else
                     timestamp = self.submitted_at.localtime.strftime("%H%M%S")
                     return "#{self.problem.name}-#{timestamp}.#{self.language.ext}"
                   end
                 end
                 protected
                 def self.find_option_in_source(option, source)
                   if source==nil
                     return nil
                   end
                   i = 0
                   source.each_line do |s|
                     if s =~ option
               	words = s.split
               	return words[1]
                     end
                     i = i + 1
                     if i==10
               	return nil
                     end
                   end
                   return nil
                 end
                 def self.find_language_in_source(source, source_filename="")
                   langopt = find_option_in_source(/^LANG:/,source)
                   if langopt
                     return (Language.find_by_name(langopt) ||
                             Language.find_by_pretty_name(langopt))
                   else
                     if source_filename
                       return Language.find_by_extension(source_filename.split('.').last)
                     else
                       return nil
                     end
                   end
                 end
                 def self.find_problem_in_source(source, source_filename="")
                   prob_opt = find_option_in_source(/^TASK:/,source)
                   if problem = Problem.find_by_name(prob_opt)
                     return problem
                   else
                     if source_filename
                       return Problem.find_by_name(source_filename.split('.').first)
                     else
                       return nil
                     end
                   end
                 end
                 def assign_problem
                   if self.problem_id!=-1
                     begin
                       self.problem = Problem.find(self.problem_id)
                     rescue ActiveRecord::RecordNotFound
                       self.problem = nil
                     end
                   else
                     self.problem = Submission.find_problem_in_source(self.source,
                                                                      self.source_filename)
                   end
                 end
                 def assign_language
                   self.language = Submission.find_language_in_source(self.source,
                                                                      self.source_filename)
                 end
                 # validation codes
                 def must_specify_language
                   return if self.source==nil
                   # for output_only tasks
                   return if self.problem!=nil and self.problem.output_only
                   if self.language==nil
                     errors.add('source',"Cannot detect language. Did you submit a correct source file?") unless self.language!=nil
                   end
                 end
                 def must_have_valid_problem
                   return if self.source==nil
                   if self.problem==nil
                     errors.add('problem',"must be specified.")
                   else
                     #admin always have right
                     return if self.user.admin?
                     #check if user has the right to submit the problem
-            -       errors.add('problem',"must be valid.") if (!self.user.available_problem.include?(self.problem)) and (self.new_record?)
+            +       errors.add('problem',"must be valid.") if (!self.user.available_problems.include?(self.problem)) and (self.new_record?)
                   end
                 end
                 # callbacks
                 def assign_latest_number_if_new_recond
                   return if !self.new_record?
                   latest = Submission.find_last_by_user_and_problem(self.user_id, self.problem_id)
                   self.number = (latest==nil) ? 1 : latest.number + 1;
                 end
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r683:d4ac431eeeb6 - Sun, 17 Sep 2017 08:17:08 - 2 files changed: 9 inserted, 7 deleted

Sign in to your account

Commit r683:d4ac431eeeb6 public

Author

r683:d4ac431eeeb6 - Sun, 17 Sep 2017 08:17:08 - 2 files changed: 9 inserted, 7 deleted

Commit `r683:d4ac431eeeb6` public