cafe-grader-web Commit - r637:d56b2e7de528

cafe-grader-web

Commit `r637:d56b2e7de528` public

parent | child

Description:

NEED TESTING move to stronger parameter for xxx.new(params[

Commit status:

[Not Reviewed]

References:

java

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

app/controllers/announcements_controller.rb ¶ +1 -1

                     format.xml  { render :xml => @announcement }
                   end
                 end
                 # GET /announcements/1/edit
                 def edit
                   @announcement = Announcement.find(params[:id])
                 end
                 # POST /announcements
                 # POST /announcements.xml
                 def create
-            -     @announcement = Announcement.new(params[:announcement])
+            +     @announcement = Announcement.new(announcement_params)
                   respond_to do |format|
                     if @announcement.save
                       flash[:notice] = 'Announcement was successfully created.'
                       format.html { redirect_to(@announcement) }
                       format.xml  { render :xml => @announcement, :status => :created, :location => @announcement }
                     else
                       format.html { render :action => "new" }
                       format.xml  { render :xml => @announcement.errors, :status => :unprocessable_entity }
                     end
                   end
                 end

app/controllers/problems_controller.rb ¶ +2 -2

                        :redirect_to => { :action => :index }
                 def show
                   @problem = Problem.find(params[:id])
                 end
                 def new
                   @problem = Problem.new
                   @description = nil
                 end
                 def create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @description = Description.new(params[:description])
                   if @description.body!=''
                     if !@description.save
                       render :action => new and return
                     end
                   else
                     @description = nil
                   end
                   @problem.description = @description
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     render :action => 'new'
                   end
                 end
                 def quick_create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @problem.full_name = @problem.name if @problem.full_name == ''
                   @problem.full_score = 100
                   @problem.available = false
                   @problem.test_allowed = true
                   @problem.output_only = false
                   @problem.date_added = Time.new
                   if @problem.save
                     flash[:notice] = 'Problem was successfully created.'
                     redirect_to action: :index
                   else
                     flash[:notice] = 'Error saving problem'
                   redirect_to action: :index

app/controllers/user_admin_controller.rb ¶ +1 -1

                   end
                 end
                 def show
                   @user = User.find(params[:id])
                 end
                 def new
                   @user = User.new
                 end
                 def create
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.activated = true
                   if @user.save
                     flash[:notice] = 'User was successfully created.'
                     redirect_to :action => 'index'
                   else
                     render :action => 'new'
                   end
                 end
                 def clear_last_ip
                   @user = User.find(params[:id])
                   @user.last_ip = nil

app/controllers/users_controller.rb ¶ +6 -2

                 end
                 def new
                   @user = User.new
                   render :action => 'new', :layout => 'empty'
                 end
                 def register
                   if(params[:cancel])
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.password_confirmation = @user.password = User.random_password
                   @user.activated = false
                   if (@user.valid?) and (@user.save)
                     if send_confirmation_email(@user)
                       render :action => 'new_splash', :layout => 'empty'
                     else
                       @admin_email = GraderConfiguration['system.admin_email']
                       render :action => 'email_error', :layout => 'empty'
                     end
                   else
                     @user.errors.add(:base,"Email cannot be blank") if @user.email==''
                     render :action => 'new', :layout => 'empty'
                 # only admins can view admins profile
                 def profile_authorization
                   #if view admins' profile, allow only admin
                   return false unless(params[:id])
                   user = User.find(params[:id])
                   return false unless user
                   return admin_authorization if user.admin?
                   return true if GraderConfiguration["right.user_view_submission"]
                   #finally, we allow only admin
                   admin_authorization
                 end
+            +
+            +   private
+            +     def user_params
+            +       params.require(:user).permit(:login, :full_name, :email)
+            +     end
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

Sign in to your account

Commit r637:d56b2e7de528 public

Author

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

Commit `r637:d56b2e7de528` public