cafe-grader-web Commit - r637:d56b2e7de528

cafe-grader-web

parent | child

Description:

NEED TESTING move to stronger parameter for xxx.new(params[

Commit status:

[Not Reviewed]

References:

java

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r637:d56b2e7de528 - Wed, 25 Jan 2017 10:06:16 - 4 files changed: 10 inserted, 6 deleted

app/controllers/announcements_controller.rb ¶ +1 -1

                   @announcement = Announcement.find(params[:id])
                 end
                 # POST /announcements
                 # POST /announcements.xml
                 def create
-            -     @announcement = Announcement.new(params[:announcement])
+            +     @announcement = Announcement.new(announcement_params)
                   respond_to do |format|
                     if @announcement.save
                       flash[:notice] = 'Announcement was successfully created.'
                       format.html { redirect_to(@announcement) }
                       format.xml  { render :xml => @announcement, :status => :created, :location => @announcement }

app/controllers/problems_controller.rb ¶ +2 -2

                 def new
                   @problem = Problem.new
                   @description = nil
                 end
                 def create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @description = Description.new(params[:description])
                   if @description.body!=''
                     if !@description.save
                       render :action => new and return
                     end
                   else
                   else
                     render :action => 'new'
                   end
                 end
                 def quick_create
-            -     @problem = Problem.new(params[:problem])
+            +     @problem = Problem.new(problem_params)
                   @problem.full_name = @problem.name if @problem.full_name == ''
                   @problem.full_score = 100
                   @problem.available = false
                   @problem.test_allowed = true
                   @problem.output_only = false
                   @problem.date_added = Time.new

app/controllers/user_admin_controller.rb ¶ +1 -1

                 def new
                   @user = User.new
                 end
                 def create
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.activated = true
                   if @user.save
                     flash[:notice] = 'User was successfully created.'
                     redirect_to :action => 'index'
                   else
                     render :action => 'new'

app/controllers/users_controller.rb ¶ +6 -2

                 def register
                   if(params[:cancel])
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
-            -     @user = User.new(params[:user])
+            +     @user = User.new(user_params)
                   @user.password_confirmation = @user.password = User.random_password
                   @user.activated = false
                   if (@user.valid?) and (@user.save)
                     if send_confirmation_email(@user)
                       render :action => 'new_splash', :layout => 'empty'
                     else
                   return admin_authorization if user.admin?
                   return true if GraderConfiguration["right.user_view_submission"]
                   #finally, we allow only admin
                   admin_authorization
                 end
+            +
+            +   private
+            +     def user_params
+            +       params.require(:user).permit(:login, :full_name, :email)
+            +     end
               end

You need to be logged in to leave comments. Login now

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings