cafe-grader-web Commit - r637:d56b2e7de528

cafe-grader-web

Commit `r637:d56b2e7de528` public

parent | child

Description:

NEED TESTING move to stronger parameter for xxx.new(params[

Commit status:

[Not Reviewed]

References:

java

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

app/controllers/announcements_controller.rb ¶ +1 -1

               class AnnouncementsController < ApplicationController
                 before_filter :admin_authorization
                 in_place_edit_for :announcement, :published
                 # GET /announcements
                 # GET /announcements.xml
                 def index
                   @announcements = Announcement.order(created_at: :desc)
                   respond_to do |format|
                     format.html # index.html.erb
                     format.xml  { render :xml => @announcements }
                   end
                 end
                 # GET /announcements/1
                 # GET /announcements/1.xml
                 def show
                   @announcement = Announcement.find(params[:id])
                   respond_to do |format|
                     format.html # show.html.erb
                     format.xml  { render :xml => @announcement }
                   end
                 end
                 # GET /announcements/new
                 # GET /announcements/new.xml
                 def new
                   @announcement = Announcement.new
                   respond_to do |format|
                     format.html # new.html.erb
                     format.xml  { render :xml => @announcement }
                   end
                 end
                 # GET /announcements/1/edit
                 def edit
                   @announcement = Announcement.find(params[:id])
                 end
                 # POST /announcements
                 # POST /announcements.xml
                 def create
-            -     @announcement = Announcement.new(params[:announcement])
+            +     @announcement = Announcement.new(announcement_params)
                   respond_to do |format|
                     if @announcement.save
                       flash[:notice] = 'Announcement was successfully created.'
                       format.html { redirect_to(@announcement) }
                       format.xml  { render :xml => @announcement, :status => :created, :location => @announcement }
                     else
                       format.html { render :action => "new" }
                       format.xml  { render :xml => @announcement.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # PUT /announcements/1
                 # PUT /announcements/1.xml
                 def update
                   @announcement = Announcement.find(params[:id])
                   respond_to do |format|
                     if @announcement.update_attributes(announcement_params)
                       flash[:notice] = 'Announcement was successfully updated.'
                       format.html { redirect_to(@announcement) }
                       format.js   {}
                       format.xml  { head :ok }
                     else
                       format.html { render :action => "edit" }
                       format.js   {}
                       format.xml  { render :xml => @announcement.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 def toggle
                   @announcement = Announcement.find(params[:id])
                   @announcement.update_attributes( published:  !@announcement.published? )
                   respond_to do |format|
                     format.js { render partial: 'toggle_button',
                                 locals: {button_id: "#announcement_toggle_#{@announcement.id}",button_on: @announcement.published? } }
                   end
                 end
                 def toggle_front
                   @announcement = Announcement.find(params[:id])
                   @announcement.update_attributes( frontpage:  !@announcement.frontpage? )
                   respond_to do |format|
                     format.js { render partial: 'toggle_button',
                                 locals: {button_id: "#announcement_toggle_front_#{@announcement.id}",button_on: @announcement.frontpage? } }
                   end
                 end
                 # DELETE /announcements/1
                 # DELETE /announcements/1.xml
                 def destroy
                   @announcement = Announcement.find(params[:id])
                   @announcement.destroy
                   respond_to do |format|
                     format.html { redirect_to(announcements_url) }
                     format.xml  { head :ok }
                   end
                 end
                 private
                   def announcement_params
                     params.require(:announcement).permit(:author, :body, :published, :frontpage, :contest_only,:title, :note)
                   end
               end

app/controllers/problems_controller.rb ¶ +2 -2

               class ProblemsController < ApplicationController
                 before_action :authenticate, :authorization
                 before_action :testcase_authorization, only: [:show_testcase]
                 in_place_edit_for :problem, :name
                 in_place_edit_for :problem, :full_name
                 in_place_edit_for :problem, :full_score
                 def index
                   @problems = Problem.order(date_added: :desc)
                 end
                 # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html)
                 verify :method => :post, :only => [ :create, :quick_create,
                                                     :do_manage,
                                                     :do_import,
                                                   ],
                        :redirect_to => { :action => :index }
                 def show
                   @problem = Problem.find(params[:id])
                 end
                 def new
                   @problem = Problem.new
                   @description = nil
                 end
                 def create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @description = Description.new(params[:description])
                   if @description.body!=''
                     if !@description.save
                       render :action => new and return
                     end
                   else
                     @description = nil
                   end
                   @problem.description = @description
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     render :action => 'new'
                   end
                 end
                 def quick_create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @problem.full_name = @problem.name if @problem.full_name == ''
                   @problem.full_score = 100
                   @problem.available = false
                   @problem.test_allowed = true
                   @problem.output_only = false
                   @problem.date_added = Time.new
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     flash[:notice] = 'Error saving problem'
                   redirect_to action: :index
                   end
                 end
                 def edit
                   @problem = Problem.find(params[:id])
                   @description = @problem.description
                 end
                 def update
                   @problem = Problem.find(params[:id])
                   @description = @problem.description
                   if @description.nil? and params[:description][:body]!=''
                     @description = Description.new(params[:description])
                     if !@description.save
                       flash[:notice] = 'Error saving description'
                       render :action => 'edit' and return
                     end
                     @problem.description = @description
                   elsif @description
                     if !@description.update_attributes(params[:description])
                       flash[:notice] = 'Error saving description'
                       render :action => 'edit' and return
                     end
                   end
                   if params[:file] and params[:file].content_type != 'application/pdf'
                       flash[:notice] = 'Error: Uploaded file is not PDF'
                       render :action => 'edit' and return
                   end
                   if @problem.update_attributes(problem_params)
                     flash[:notice] = 'Problem was successfully updated.'
                     unless params[:file] == nil or params[:file] == ''
                       flash[:notice] = 'Problem was successfully updated and a new PDF file is uploaded.'
                       out_dirname = "#{Problem.download_file_basedir}/#{@problem.id}"
                       if not FileTest.exists? out_dirname
                         Dir.mkdir out_dirname
                       end
                       out_filename = "#{out_dirname}/#{@problem.name}.pdf"
                       if FileTest.exists? out_filename
                         File.delete out_filename
                       end
                       File.open(out_filename,"wb") do |file|
                         file.write(params[:file].read)
                       end
                       @problem.description_filename = "#{@problem.name}.pdf"
                       @problem.save
                     end
                     redirect_to :action => 'show', :id => @problem
                   else
                     render :action => 'edit'
                   end
                 end
                 def destroy
                   p = Problem.find(params[:id]).destroy
                   redirect_to action: :index
                 end
                 def toggle
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(available: !(@problem.available) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def toggle_test
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(test_allowed: !(@problem.test_allowed?) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def toggle_view_testcase
                   @problem = Problem.find(params[:id])
                   @problem.update_attributes(view_testcase: !(@problem.view_testcase?) )
                   respond_to do |format|
                     format.js { }
                   end
                 end
                 def turn_all_off
                   Problem.available.all.each do |problem|
                     problem.available = false
                     problem.save
                   end
                   redirect_to action: :index
                 end
                 def turn_all_on
                   Problem.where.not(available: true).each do |problem|
                     problem.available = true
                     problem.save
                   end
                   redirect_to action: :index
                 end
                 def stat
                   @problem = Problem.find(params[:id])
                   unless @problem.available or session[:admin]
                     redirect_to :controller => 'main', :action => 'list'
                     return
                   end
                   @submissions = Submission.includes(:user).where(problem_id: params[:id]).order(:user_id,:id)
                   #stat summary
                   range =65
                   @histogram = { data: Array.new(range,0), summary: {} }
                   user = Hash.new(0)
                   @submissions.find_each do |sub|
                     d = (DateTime.now.in_time_zone - sub.submitted_at) / 24 / 60 / 60
                     @histogram[:data][d.to_i] += 1 if d < range
                     user[sub.user_id] = [user[sub.user_id], ((sub.try(:points) || 0) >= @problem.full_score) ? 1 : 0].max
                   end
                   @histogram[:summary][:max] = [@histogram[:data].max,1].max
                   @summary = { attempt: user.count, solve: 0 }
                   user.each_value { |v| @summary[:solve] += 1 if v == 1 }
                 end
                 def manage
                   @problems = Problem.order(date_added: :desc)
                 end
                 def do_manage
                   if params.has_key? 'change_date_added'
                     change_date_added
                   elsif params.has_key? 'add_to_contest'
                     add_to_contest
                   elsif params.has_key? 'enable_problem'
                     set_available(true)
                   elsif params.has_key? 'disable_problem'
                     set_available(false)
                   end
                   redirect_to :action => 'manage'
                 end
                 def import
                   @allow_test_pair_import = allow_test_pair_import?
                 end
                 def do_import
                   old_problem = Problem.find_by_name(params[:name])
                   if !allow_test_pair_import? and params.has_key? :import_to_db
                     params.delete :import_to_db
                   end
                   @problem, import_log = Problem.create_from_import_form_params(params,
                                                                                 old_problem)
                   if !@problem.errors.empty?
                     render :action => 'import' and return
                   end
                   if old_problem!=nil
                     flash[:notice] = "The test data has been replaced for problem #{@problem.name}"
                   end
                   @log = import_log
                 end
                 def remove_contest
                   problem = Problem.find(params[:id])
                   contest = Contest.find(params[:contest_id])
                   if problem!=nil and contest!=nil
                     problem.contests.delete(contest)
                   end
                   redirect_to :action => 'manage'
                 end
                 ##################################
                 protected
                 def allow_test_pair_import?
                   if defined? ALLOW_TEST_PAIR_IMPORT
                     return ALLOW_TEST_PAIR_IMPORT
                   else
                     return false
                   end
                 end
                 def change_date_added
                   problems = get_problems_from_params
                   year = params[:date_added][:year].to_i
                   month = params[:date_added][:month].to_i
                   day = params[:date_added][:day].to_i
                   date = Date.new(year,month,day)
                   problems.each do |p|
                     p.date_added = date
                     p.save
                   end
                 end
                 def add_to_contest
                   problems = get_problems_from_params
                   contest = Contest.find(params[:contest][:id])
                   if contest!=nil and contest.enabled
                     problems.each do |p|
                       p.contests << contest
                     end
                   end
                 end
                 def set_available(avail)
                   problems = get_problems_from_params
                   problems.each do |p|
                     p.available = avail
                     p.save
                   end
                 end
                 def get_problems_from_params
                   problems = []
                   params.keys.each do |k|
                     if k.index('prob-')==0
                       name, id, order = k.split('-')
                       problems << Problem.find(id)
                     end
                   end
                   problems
                 end
                 def get_problems_stat
                 end
                 private
                   def problem_params
                     params.require(:problem).permit(:name, :full_name, :full_score, :date_added, :available, :test_allowed,:output_only, :url, :description)
                   end
               end

app/controllers/user_admin_controller.rb ¶ +1 -1

               require 'csv'
               class UserAdminController < ApplicationController
                 include MailHelperMethods
                 before_filter :admin_authorization
                 # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html)
                 verify :method => :post, :only => [
                                                     :create, :create_from_list,
                                                     :update,
                                                     :manage_contest,
                                                     :bulk_mail
                                                   ],
                        :redirect_to => { :action => :list }
                 def index
                   @user_count = User.count
                   if params[:page] == 'all'
                     @users = User.all
                     @paginated = false
                   else
                     @users = User.paginate :page => params[:page]
                     @paginated = true
                   end
                   @hidden_columns = ['hashed_password', 'salt', 'created_at', 'updated_at']
                   @contests = Contest.enabled
                 end
                 def active
                   sessions = ActiveRecord::SessionStore::Session.where("updated_at >= ?", 60.minutes.ago)
                   @users = []
                   sessions.each do |session|
                     if session.data[:user_id]
                       @users << User.find(session.data[:user_id])
                     end
                   end
                 end
                 def show
                   @user = User.find(params[:id])
                 end
                 def new
                   @user = User.new
                 end
                 def create
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.activated = true
                   if @user.save
                     flash[:notice] = 'User was successfully created.'
                     redirect_to :action => 'index'
                   else
                     render :action => 'new'
                   end
                 end
                 def clear_last_ip
                   @user = User.find(params[:id])
                   @user.last_ip = nil
                   @user.save
                   redirect_to action: 'index', page: params[:page]
                 end
                 def create_from_list
                   lines = params[:user_list]
                   note = []
                   lines.split("\n").each do |line|
                     items = line.chomp.split(',')
                     if items.length>=2
                       login = items[0]
                       full_name = items[1]
                       remark =''
                       user_alias = ''
                       added_random_password = false
                       if items.length >= 3 and items[2].chomp(" ").length > 0;
                         password = items[2].chomp(" ")
                       else
                         password = random_password
                         add_random_password=true;
                       end
                       if items.length>= 4 and items[3].chomp(" ").length > 0;
                         user_alias = items[3].chomp(" ")
                       else
                         user_alias = login
                       end
                       if items.length>=5
                         remark = items[4].strip;
                       end
                       user = User.find_by_login(login)
                       if (user)
                         user.full_name = full_name
                         user.password = password
                         user.remark = remark
                       else
                         user = User.new({:login => login,
                                           :full_name => full_name,
                                           :password => password,
                                           :password_confirmation => password,
                                           :alias => user_alias,
                                           :remark => remark})
                       end
                       user.activated = true
                       user.save
                       if added_random_password
                         note << "'#{login}' (+)"
                       else
                         note << login
                       end
                     end
                   end
                   flash[:success] = 'User(s) ' + note.join(', ') +
                     ' were successfully created.  ' +
                     '( (+) - created with random passwords.)'
                   redirect_to :action => 'index'
                 end
                 def edit
                   @user = User.find(params[:id])
                 end
                 def update
                   @user = User.find(params[:id])
                   if @user.update_attributes(user_params)
                     flash[:notice] = 'User was successfully updated.'
                     redirect_to :action => 'show', :id => @user
                   else
                     render :action => 'edit'
                   end
                 end
                 def destroy
                   User.find(params[:id]).destroy
                   redirect_to :action => 'index'
                 end
                 def user_stat
                   if params[:commit] == 'download csv'
                     @problems = Problem.all
                   else
                     @problems = Problem.available_problems
                   end
                   @users = User.includes(:contests, :contest_stat).where(enabled: true)
                   @scorearray = Array.new
                   @users.each do |u|
                     ustat = Array.new
                     ustat[0] = u
                     @problems.each do |p|
                       sub = Submission.find_last_by_user_and_problem(u.id,p.id)
                       if (sub!=nil) and (sub.points!=nil) and p and p.full_score
                         ustat << [(sub.points.to_f*100/p.full_score).round, (sub.points>=p.full_score)]
                       else
                         ustat << [0,false]
                       end
                     end
                     @scorearray << ustat
                   end
                   if params[:commit] == 'download csv' then
                     csv = gen_csv_from_scorearray(@scorearray,@problems)
                     send_data csv, filename: 'last_score.csv'
                   else
                     render template: 'user_admin/user_stat'
                   end
                 end
                 def user_stat_max
                   if params[:commit] == 'download csv'
                     @problems = Problem.all
                   else
                     @problems = Problem.available_problems
                   end
                   @users = User.includes(:contests).includes(:contest_stat).all
                   @scorearray = Array.new
                   #set up range from param
                   since_id = params.fetch(:since_id, 0).to_i
                   until_id = params.fetch(:until_id, 0).to_i
                   @users.each do |u|
                     ustat = Array.new
                     ustat[0] = u
                     @problems.each do |p|
                       max_points = 0
                       Submission.find_in_range_by_user_and_problem(u.id,p.id,since_id,until_id).each do |sub|
                         max_points = sub.points if sub and sub.points and (sub.points > max_points)
                       end
                       ustat << [(max_points.to_f*100/p.full_score).round, (max_points>=p.full_score)]
                     end
                     @scorearray << ustat
                   end
                   if params[:commit] == 'download csv' then
                     csv = gen_csv_from_scorearray(@scorearray,@problems)
                     send_data csv, filename: 'max_score.csv'
                   else
                     render template: 'user_admin/user_stat'
                   end
                 end
                 def import
                   if params[:file]==''
                     flash[:notice] = 'Error importing no file'
                     redirect_to :action => 'index' and return
                   end
                   import_from_file(params[:file])
                 end
                 def random_all_passwords
                   users = User.all
                   @prefix = params[:prefix] || ''
                   @non_admin_users = User.find_non_admin_with_prefix(@prefix)
                   @changed = false
                   if request.request_method == 'POST'
                     @non_admin_users.each do |user|
                       password = random_password
                       user.password = password
                       user.password_confirmation = password
                       user.save
                     end
                     @changed = true
                   end
                 end
                 # contest management
                 def contests
                   @contest, @users = find_contest_and_user_from_contest_id(params[:id])
                   @contests = Contest.enabled
                 end
                 def assign_from_list
                   contest_id = params[:users_contest_id]
                   org_contest, users = find_contest_and_user_from_contest_id(contest_id)
                   contest = Contest.find(params[:new_contest][:id])
                   if !contest
                     flash[:notice] = 'Error: no contest'
                     redirect_to :action => 'contests', :id =>contest_id
                   end
                   note = []
                   users.each do |u|
                     u.contests = [contest]
                     note << u.login
                   end
                   flash[:notice] = 'User(s) ' + note.join(', ') +
                     " were successfully reassigned to #{contest.title}."
                   redirect_to :action => 'contests', :id =>contest.id
                 end
                 def add_to_contest
                   user = User.find(params[:id])
                   contest = Contest.find(params[:contest_id])
                   if user and contest
                     user.contests << contest
                   end
                   redirect_to :action => 'index'
                 end
                 def remove_from_contest
                   user = User.find(params[:id])
                   contest = Contest.find(params[:contest_id])
                   if user and contest
                     user.contests.delete(contest)
                   end
                   redirect_to :action => 'index'
                 end
                 def contest_management
                 end
                 def manage_contest
                   contest = Contest.find(params[:contest][:id])
                   if !contest
                     flash[:notice] = 'You did not choose the contest.'
                     redirect_to :action => 'contest_management' and return
                   end
                   operation = params[:operation]
                   if not ['add','remove','assign'].include? operation
                     flash[:notice] = 'You did not choose the operation to perform.'
                     redirect_to :action => 'contest_management' and return
                   end
                   lines = params[:login_list]
                   if !lines or lines.blank?
                     flash[:notice] = 'You entered an empty list.'
                     redirect_to :action => 'contest_management' and return
                   end
                   note = []
                   users = []
                   lines.split("\n").each do |line|
                     user = User.find_by_login(line.chomp)
                     if user
                       if operation=='add'
                         if ! user.contests.include? contest
                           user.contests << contest
                         end
                       elsif operation=='remove'
                         user.contests.delete(contest)
                       else
                         user.contests = [contest]
                       end
                       if params[:reset_timer]
                         user.contest_stat.forced_logout = true
                         user.contest_stat.reset_timer_and_save
                       end
                       if params[:notification_emails]
                         send_contest_update_notification_email(user, contest)
                       end
                       note << user.login
                       users << user
                     end
                   end
                   if params[:reset_timer]
                     logout_users(users)
                   end
                   flash[:notice] = 'User(s) ' + note.join(', ') +
                     ' were successfully modified.  '
                   redirect_to :action => 'contest_management'
                 end
                 # admin management
                 def admin
                   @admins = User.all.find_all {|user| user.admin? }
                 end
                 def grant_admin
                   login = params[:login]
                   user = User.find_by_login(login)
                   if user!=nil
                     admin_role = Role.find_by_name('admin')
                     user.roles << admin_role
                   else
                     flash[:notice] = 'Unknown user'
                   end
                   flash[:notice] = 'User added as admins'
                   redirect_to :action => 'admin'
                 end
                 def revoke_admin
                   user = User.find(params[:id])
                   if user==nil
                     flash[:notice] = 'Unknown user'
                     redirect_to :action => 'admin' and return
                   elsif user.login == 'root'
                     flash[:notice] = 'You cannot revoke admisnistrator permission from root.'
                     redirect_to :action => 'admin' and return
                   end
                   admin_role = Role.find_by_name('admin')
                   user.roles.delete(admin_role)
                   flash[:notice] = 'User permission revoked'
                   redirect_to :action => 'admin'
                 end
                 # mass mailing
                 def mass_mailing
                 end
                 def bulk_mail
                   lines = params[:login_list]
                   if !lines or lines.blank?
                     flash[:notice] = 'You entered an empty list.'
                     redirect_to :action => 'mass_mailing' and return
                   end
                   mail_subject = params[:subject]
                   if !mail_subject or mail_subject.blank?
                     flash[:notice] = 'You entered an empty mail subject.'
                     redirect_to :action => 'mass_mailing' and return
                   end
                   mail_body = params[:email_body]
                   if !mail_body or mail_body.blank?
                     flash[:notice] = 'You entered an empty mail body.'
                     redirect_to :action => 'mass_mailing' and return
                   end
                   note = []
                   users = []
                   lines.split("\n").each do |line|
                     user = User.find_by_login(line.chomp)
                     if user
                       send_mail(user.email, mail_subject, mail_body)
                       note << user.login
                     end
                   end
                   flash[:notice] = 'User(s) ' + note.join(', ') +
                     ' were successfully modified.  '
                   redirect_to :action => 'mass_mailing'
                 end
                 protected
                 def random_password(length=5)
                   chars = 'abcdefghijkmnopqrstuvwxyz23456789'
                   newpass = ""
                   length.times { newpass << chars[rand(chars.size-1)] }
                   return newpass
                 end
                 def import_from_file(f)
                   data_hash = YAML.load(f)
                   @import_log = ""
                   country_data = data_hash[:countries]
                   site_data = data_hash[:sites]
                   user_data = data_hash[:users]
                   # import country
                   countries = {}
                   country_data.each_pair do |id,country|
                     c = Country.find_by_name(country[:name])
                     if c!=nil
                       countries[id] = c
                       @import_log << "Found #{country[:name]}\n"
                     else
                       countries[id] = Country.new(:name => country[:name])
                       countries[id].save
                       @import_log << "Created #{country[:name]}\n"
                     end
                   end
                   # import sites
                   sites = {}
                   site_data.each_pair do |id,site|
                     s = Site.find_by_name(site[:name])
                     if s!=nil
                       @import_log << "Found #{site[:name]}\n"
                     else
                       s = Site.new(:name => site[:name])
                       @import_log << "Created #{site[:name]}\n"
                     end
                     s.password = site[:password]
                     s.country = countries[site[:country_id]]
                     s.save
                     sites[id] = s
                   end
                   # import users
                   user_data.each_pair do |id,user|
                     u = User.find_by_login(user[:login])
                     if u!=nil
                       @import_log << "Found #{user[:login]}\n"
                     else
                       u = User.new(:login => user[:login])
                       @import_log << "Created #{user[:login]}\n"
                     end
                     u.full_name = user[:name]
                     u.password = user[:password]
                     u.country = countries[user[:country_id]]
                     u.site = sites[user[:site_id]]
                     u.activated = true
                     u.email = "empty-#{u.login}@none.com"
                     if not u.save
                       @import_log << "Errors\n"
                       u.errors.each { |attr,msg|  @import_log << "#{attr} - #{msg}\n" }
                     end
                   end
                 end
                 def logout_users(users)
                   users.each do |user|
                     contest_stat = user.contest_stat(true)
                     if contest_stat and !contest_stat.forced_logout
                       contest_stat.forced_logout = true
                       contest_stat.save
                     end
                   end
                 end
                 def send_contest_update_notification_email(user, contest)
                   contest_title_name = GraderConfiguration['contest.name']
                   contest_name = contest.name
                   mail_subject = t('contest.notification.email_subject', {
                                      :contest_title_name => contest_title_name,
                                      :contest_name => contest_name })
                   mail_body = t('contest.notification.email_body', {
                                   :full_name => user.full_name,
                                   :contest_title_name => contest_title_name,
                                   :contest_name => contest.name,
                                 })
                   logger.info mail_body
                   send_mail(user.email, mail_subject, mail_body)
                 end
                 def find_contest_and_user_from_contest_id(id)
                   if id!='none'
                     @contest = Contest.find(id)
                   else
                     @contest = nil
                   end
                   if @contest
                     @users = @contest.users
                   else
                     @users = User.find_users_with_no_contest
                   end
                   return [@contest, @users]
                 end
                 def gen_csv_from_scorearray(scorearray,problem)
                   CSV.generate do |csv|
                     #add header
                     header = ['User','Name', 'Activated?', 'Logged in', 'Contest']
                     problem.each { |p| header << p.name }
                     header += ['Total','Passed']
                     csv << header
                     #add data
                     scorearray.each do |sc|
                       total = num_passed = 0
                       row = Array.new
                       sc.each_index do |i|
                         if i == 0
                           row << sc[i].login
                           row << sc[i].full_name
                           row << sc[i].activated
                           row << (sc[i].try(:contest_stat).try(:started_at).nil? ? 'no' : 'yes')
                           row << sc[i].contests.collect {|c| c.name}.join(', ')
                         else
                           row << sc[i][0]
                           total += sc[i][0]
                           num_passed += 1 if sc[i][1]
                         end
                       end
                       row << total
                       row << num_passed
                       csv << row
                     end
                   end
                 end
                 private
                   def user_params
                     params.require(:user).permit(:login,:full_name,:hashed_password,:salt,:alias,:email,:site_id,:country_id,:activated,:enabled,:remark,:last_ip,:section)
                   end
               end

app/controllers/users_controller.rb ¶ +6 -2

               require 'net/smtp'
               class UsersController < ApplicationController
                 include MailHelperMethods
                 before_filter :authenticate, :except => [:new,
                                                          :register,
                                                          :confirm,
                                                          :forget,
                                                          :retrieve_password]
                 before_filter :verify_online_registration, :only => [:new,
                                                                      :register,
                                                                      :forget,
                                                                      :retrieve_password]
                 before_filter :authenticate, :profile_authorization, only: [:profile]
                 verify :method => :post, :only => [:chg_passwd],
                        :redirect_to => { :action => :index }
                 #in_place_edit_for :user, :alias_for_editing
                 #in_place_edit_for :user, :email_for_editing
                 def index
                   if !GraderConfiguration['system.user_setting_enabled']
                     redirect_to :controller => 'main', :action => 'list'
                   else
                     @user = User.find(session[:user_id])
                   end
                 end
                 def chg_passwd
                   user = User.find(session[:user_id])
                   user.password = params[:passwd]
                   user.password_confirmation = params[:passwd_verify]
                   if user.save
                     flash[:notice] = 'password changed'
                   else
                     flash[:notice] = 'Error: password changing failed'
                   end
                   redirect_to :action => 'index'
                 end
                 def new
                   @user = User.new
                   render :action => 'new', :layout => 'empty'
                 end
                 def register
                   if(params[:cancel])
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.password_confirmation = @user.password = User.random_password
                   @user.activated = false
                   if (@user.valid?) and (@user.save)
                     if send_confirmation_email(@user)
                       render :action => 'new_splash', :layout => 'empty'
                     else
                       @admin_email = GraderConfiguration['system.admin_email']
                       render :action => 'email_error', :layout => 'empty'
                     end
                   else
                     @user.errors.add(:base,"Email cannot be blank") if @user.email==''
                     render :action => 'new', :layout => 'empty'
                   end
                 end
                 def confirm
                   login = params[:login]
                   key = params[:activation]
                   @user = User.find_by_login(login)
                   if (@user) and (@user.verify_activation_key(key))
                     if @user.valid?  # check uniquenss of email
                       @user.activated = true
                       @user.save
                       @result = :successful
                     else
                       @result = :email_used
                     end
                   else
                     @result = :failed
                   end
                   render :action => 'confirm', :layout => 'empty'
                 end
                 def forget
                   render :action => 'forget', :layout => 'empty'
                 end
                 def retrieve_password
                   email = params[:email]
                   user = User.find_by_email(email)
                   if user
                     last_updated_time = user.updated_at || user.created_at || (Time.now.gmtime - 1.hour)
                     if last_updated_time > Time.now.gmtime - 5.minutes
                       flash[:notice] = 'The account has recently created or new password has recently been requested.  Please wait for 5 minutes'
                     else
                       user.password = user.password_confirmation = User.random_password
                       user.save
                       send_new_password_email(user)
                       flash[:notice] = 'New password has been mailed to you.'
                     end
                   else
                     flash[:notice] = I18n.t 'registration.password_retrieval.no_email'
                   end
                   redirect_to :action => 'forget'
                 end
                 def stat
                   @user = User.find(params[:id])
                   @submission = Submission.includes(:problem).where(user_id: params[:id])
                   range = 120
                   @histogram = { data: Array.new(range,0), summary: {} }
                   @summary = {count: 0, solve: 0, attempt: 0}
                   problem = Hash.new(0)
                   @submission.find_each do |sub|
                     #histogram
                     d = (DateTime.now.in_time_zone - sub.submitted_at) / 24 / 60 / 60
                     @histogram[:data][d.to_i] += 1 if d < range
                     @summary[:count] += 1
                     next unless sub.problem
                     problem[sub.problem] = [problem[sub.problem], ( (sub.try(:points) || 0) >= sub.problem.full_score) ? 1 : 0].max
                   end
                   @histogram[:summary][:max] = [@histogram[:data].max,1].max
                   @summary[:attempt] = problem.count
                   problem.each_value { |v| @summary[:solve] += 1 if v == 1 }
                 end
                 def toggle_activate
                   @user = User.find(params[:id])
                   @user.update_attributes( activated:  !@user.activated? )
                   respond_to do |format|
                     format.js { render partial: 'toggle_button',
                                 locals: {button_id: "#toggle_activate_user_#{@user.id}",button_on: @user.activated? } }
                   end
                 end
                 def toggle_enable
                   @user = User.find(params[:id])
                   @user.update_attributes( enabled:  !@user.enabled? )
                   respond_to do |format|
                     format.js { render partial: 'toggle_button',
                                 locals: {button_id: "#toggle_enable_user_#{@user.id}",button_on: @user.enabled? } }
                   end
                 end
                 protected
                 def verify_online_registration
                   if !GraderConfiguration['system.online_registration']
                     redirect_to :controller => 'main', :action => 'login'
                   end
                 end
                 def send_confirmation_email(user)
                   contest_name = GraderConfiguration['contest.name']
                   activation_url = url_for(:action => 'confirm',
                                            :login => user.login,
                                            :activation => user.activation_key)
                   home_url = url_for(:controller => 'main', :action => 'index')
                   mail_subject = "[#{contest_name}] Confirmation"
                   mail_body = t('registration.email_body', {
                                   :full_name => user.full_name,
                                   :contest_name => contest_name,
                                   :login => user.login,
                                   :password => user.password,
                                   :activation_url => activation_url,
                                   :admin_email => GraderConfiguration['system.admin_email']
                                 })
                   logger.info mail_body
                   send_mail(user.email, mail_subject, mail_body)
                 end
                 def send_new_password_email(user)
                   contest_name = GraderConfiguration['contest.name']
                   mail_subject = "[#{contest_name}] Password recovery"
                   mail_body = t('registration.password_retrieval.email_body', {
                                   :full_name => user.full_name,
                                   :contest_name => contest_name,
                                   :login => user.login,
                                   :password => user.password,
                                   :admin_email => GraderConfiguration['system.admin_email']
                                 })
                   logger.info mail_body
                   send_mail(user.email, mail_subject, mail_body)
                 end
                 # allow viewing of regular user profile only when options allow so
                 # only admins can view admins profile
                 def profile_authorization
                   #if view admins' profile, allow only admin
                   return false unless(params[:id])
                   user = User.find(params[:id])
                   return false unless user
                   return admin_authorization if user.admin?
                   return true if GraderConfiguration["right.user_view_submission"]
                   #finally, we allow only admin
                   admin_authorization
                 end
+            +
+            +   private
+            +     def user_params
+            +       params.require(:user).permit(:login, :full_name, :email)
+            +     end
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

Sign in to your account

Commit r637:d56b2e7de528 public

Author

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

Commit `r637:d56b2e7de528` public