cafe-grader-web Commit - r617:f062e467ef5c

cafe-grader-web

Commit `r617:f062e467ef5c` public

parent | child

Description:

switch to strong parameter for mass update (have not finished the problem controller yet)

Commit status:

[Not Reviewed]

References:

toRails40

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r617:f062e467ef5c - Mon, 28 Nov 2016 10:31:29 - 10 files changed: 42 inserted, 63 deleted

app/controllers/announcements_controller.rb ¶ +7 -1

                       format.html { render :action => "new" }
                       format.xml  { render :xml => @announcement.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # PUT /announcements/1
                 # PUT /announcements/1.xml
                 def update
                   @announcement = Announcement.find(params[:id])
                   respond_to do |format|
-            -       if @announcement.update_attributes(params[:announcement])
+            +       if @announcement.update_attributes(announcement_params)
                       flash[:notice] = 'Announcement was successfully updated.'
                       format.html { redirect_to(@announcement) }
                       format.js   {}
                       format.xml  { head :ok }
                     else
                       format.html { render :action => "edit" }
                       format.js   {}
                       format.xml  { render :xml => @announcement.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # DELETE /announcements/1
                 # DELETE /announcements/1.xml
                 def destroy
                   @announcement = Announcement.find(params[:id])
                   @announcement.destroy
                   respond_to do |format|
                     format.html { redirect_to(announcements_url) }
                     format.xml  { head :ok }
                   end
                 end
+            +
+            +   private
+            +
+            +     def announcement_params
+            +       params.require(:announcement).permit(:author, :body, :published, :frontpage, :contest_only,:title, :note)
+            +     end
               end

app/controllers/configurations_controller.rb ¶ +6 -1

                   @group = GraderConfiguration.pluck("grader_configurations.key").map{ |x| x[0...(x.index('.'))] }.uniq.sort
                 end
                 def reload
                   GraderConfiguration.reload
                   redirect_to :action => 'index'
                 end
                 def update
                   @config = GraderConfiguration.find(params[:id])
                   User.clear_last_login if @config.key == GraderConfiguration::MULTIPLE_IP_LOGIN_KEY and @config.value == 'true' and params[:grader_configuration][:value] == 'false'
                   respond_to do |format|
-            -       if @config.update_attributes(params[:grader_configuration])
+            +       if @config.update_attributes(configuration_params)
                       format.json { head :ok }
                     else
                       format.json { respond_with_bip(@config) }
                     end
                   end
                 end
+            + private
+            +   def configuration_params
+            +     params.require(:grader_configuration).permit(:key,:value_type,:value,:description)
+            +   end
+            +
               end

app/controllers/contests_controller.rb ¶ +7 -1

                       format.html { render :action => "new" }
                       format.xml  { render :xml => @contest.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # PUT /contests/1
                 # PUT /contests/1.xml
                 def update
                   @contest = Contest.find(params[:id])
                   respond_to do |format|
-            -       if @contest.update_attributes(params[:contest])
+            +       if @contest.update_attributes(contests_params)
                       flash[:notice] = 'Contest was successfully updated.'
                       format.html { redirect_to(@contest) }
                       format.xml  { head :ok }
                     else
                       format.html { render :action => "edit" }
                       format.xml  { render :xml => @contest.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # DELETE /contests/1
                 # DELETE /contests/1.xml
                 def destroy
                   @contest = Contest.find(params[:id])
                   @contest.destroy
                   respond_to do |format|
                     format.html { redirect_to(contests_url) }
                     format.xml  { head :ok }
                   end
                 end
+            +   private
+            +
+            +     def contests_params
+            +       params.require(:contest).permit(:title,:enabled,:name)
+            +     end
+            +
               end

app/controllers/site_controller.rb ¶ +5

                     redirect_to :controller => 'site', :action => 'login' and return
                   end
                   begin
                     @site = Site.find(session[:site_id], :include => :country)
                   rescue ActiveRecord::RecordNotFound
                     @site = nil
                   end
                   if @site==nil
                     redirect_to :controller => 'site', :action => 'login' and return
                   end
                 end
+            +   private
+            +     def site_params
+            +       params.require(:site).permit()
+            +     end
+            +
               end

app/controllers/sites_controller.rb ¶ +7 -1

                       format.xml  { render :xml => @site.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # PUT /sites/1
                 # PUT /sites/1.xml
                 def update
                   @site = Site.find(params[:id])
                   @site.clear_start_time_if_not_started
                   respond_to do |format|
-            -       if @site.update_attributes(params[:site])
+            +       if @site.update_attributes(site_params)
                       flash[:notice] = 'Site was successfully updated.'
                       format.html { redirect_to(@site) }
                       format.xml  { head :ok }
                     else
                       format.html { render :action => "edit" }
                       format.xml  { render :xml => @site.errors, :status => :unprocessable_entity }
                     end
                   end
                 end
                 # DELETE /sites/1
                 # DELETE /sites/1.xml
                 def destroy
                   @site = Site.find(params[:id])
                   @site.destroy
                   respond_to do |format|
                     format.html { redirect_to(sites_url) }
                     format.xml  { head :ok }
                   end
                 end
+            +   private
+            +
+            +     def site_params
+            +       params.require(:site).permit(:name,:started,:start_time,:country_id,:password)
+            +     end
+            +
               end

app/controllers/submissions_controller.rb ¶ +1 -55

@@ -51,87 +51,33
51		51
52	def get_latest_submission_status	52	def get_latest_submission_status
53	@problem = Problem.find(params[:pid])	53	@problem = Problem.find(params[:pid])
54	@submission = Submission.find_last_by_user_and_problem(params[:uid],params[:pid])	54	@submission = Submission.find_last_by_user_and_problem(params[:uid],params[:pid])
55	puts User.find(params[:uid]).login	55	puts User.find(params[:uid]).login
56	puts Problem.find(params[:pid]).name	56	puts Problem.find(params[:pid]).name
57	puts 'nil' unless @submission	57	puts 'nil' unless @submission
58	respond_to do \|format\|	58	respond_to do \|format\|
59	format.js	59	format.js
60	end	60	end
61	end	61	end
62		62
63	- # # GET /submissions/new
64	- # # GET /submissions/new.json
65	- # def new
66	- # @submission = Submission.new
67	- #
68	- # respond_to do \|format\|
69	- # format.html # new.html.erb
70	- # format.json { render json: @submission }
71	- # end
72	- # end
73	- #
74	- #
75	- # # POST /submissions
76	- # # POST /submissions.json
77	- # def create
78	- # @submission = Submission.new(params[:submission])
79	- #
80	- # respond_to do \|format\|
81	- # if @submission.save
82	- # format.html { redirect_to @submission, notice: 'Submission was successfully created.' }
83	- # format.json { render json: @submission, status: :created, location: @submission }
84	- # else
85	- # format.html { render action: "new" }
86	- # format.json { render json: @submission.errors, status: :unprocessable_entity }
87	- # end
88	- # end
89	- # end
90	- #
91	- # # PUT /submissions/1
92	- # # PUT /submissions/1.json
93	- # def update
94	- # @submission = Submission.find(params[:id])
95	- #
96	- # respond_to do \|format\|
97	- # if @submission.update_attributes(params[:submission])
98	- # format.html { redirect_to @submission, notice: 'Submission was successfully updated.' }
99	- # format.json { head :no_content }
100	- # else
101	- # format.html { render action: "edit" }
102	- # format.json { render json: @submission.errors, status: :unprocessable_entity }
103	- # end
104	- # end
105	- # end
106	- #
107	- # # DELETE /submissions/1
108	- # # DELETE /submissions/1.json
109	- # def destroy
110	- # @submission = Submission.find(params[:id])
111	- # @submission.destroy
112	- #
113	- # respond_to do \|format\|
114	- # format.html { redirect_to submissions_url }
115	- # format.json { head :no_content }
116	- # end
117	- # end
118		63
119	protected	64	protected
120	def submission_authorization	65	def submission_authorization
121	#admin always has privileged	66	#admin always has privileged
122	if @current_user.admin?	67	if @current_user.admin?
123	return true	68	return true
124	end	69	end
125		70
126	sub = Submission.find(params[:id])	71	sub = Submission.find(params[:id])
127	if sub.problem.available?	72	if sub.problem.available?
128	puts "sub = #{sub.user.id}, current = #{@current_user.id}"	73	puts "sub = #{sub.user.id}, current = #{@current_user.id}"
129	return true if GraderConfiguration["right.user_view_submission"] or sub.user == @current_user	74	return true if GraderConfiguration["right.user_view_submission"] or sub.user == @current_user
130	end	75	end
131		76
132	#default to NO	77	#default to NO
133	unauthorized_redirect	78	unauthorized_redirect
134	return false	79	return false
135	end	80	end
		81	+
136		82
137	end	83	end

app/controllers/user_admin_controller.rb ¶ +6 -1

                   flash[:notice] = 'User(s) ' + note.join(', ') +
                     ' were successfully created.  ' +
                     '( (+) - created with random passwords.)'
                   redirect_to :action => 'index'
                 end
                 def edit
                   @user = User.find(params[:id])
                 end
                 def update
                   @user = User.find(params[:id])
-            -     if @user.update_attributes(params[:user])
+            +     if @user.update_attributes(user_params)
                     flash[:notice] = 'User was successfully updated.'
                     redirect_to :action => 'show', :id => @user
                   else
                     render :action => 'edit'
                   end
                 end
                 def destroy
                   User.find(params[:id]).destroy
                   redirect_to :action => 'index'
                 end
                         else
                           row << sc[i][0]
                           total += sc[i][0]
                           num_passed += 1 if sc[i][1]
                         end
                       end
                       row << total
                       row << num_passed
                       csv << row
                     end
                   end
                 end
+            +
+            +   private
+            +     def user_params
+            +       params.require(:user).permit(:login,:full_name,:hashed_password,:salt,:alias,:email,:site_id,:country_id,:activated,:enabled,:remark,:last_ip,:section)
+            +     end
               end

app/models/user.rb ¶ +1 -1

                 has_one :contest_stat, :class_name => "UserContestStat", :dependent => :destroy
                 belongs_to :site
                 belongs_to :country
                 has_and_belongs_to_many :contests, :uniq => true, :order => 'name'
                 scope :activated_users, :conditions => {:activated => true}
                 validates_presence_of :login
                 validates_uniqueness_of :login
-            -   validates_format_of :login, :with => /^[\_A-Za-z0-9]+$/
+            +   validates_format_of :login, :with => /\A[\_A-Za-z0-9]+\z/
                 validates_length_of :login, :within => 3..30
                 validates_presence_of :full_name
                 validates_length_of :full_name, :minimum => 1
                 validates_presence_of :password, :if => :password_required?
                 validates_length_of :password, :within => 4..20, :if => :password_required?
                 validates_confirmation_of :password, :if => :password_required?
                 validates_format_of :email,
                                     :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i,
                                     :if => :email_validation?

config/environments/development.rb ¶ +1 -1

                 config.action_controller.perform_caching = false
                 # Don't care if the mailer can't send
                 config.action_mailer.raise_delivery_errors = false
                 # Print deprecation notices to the Rails logger
                 config.active_support.deprecation = :log
                 # Only use best-standards-support built into browsers
                 config.action_dispatch.best_standards_support = :builtin
                 # Raise exception on mass assignment protection for Active Record models
-            -   config.active_record.mass_assignment_sanitizer = :strict
+            +   # config.active_record.mass_assignment_sanitizer = :strict //DEPRICATED
                 # Log the query plan for queries taking more than this (works // DEPRICATED
                 # with SQLite, MySQL, and PostgreSQL) // DEPRICATED
                 # config.active_record.auto_explain_threshold_in_seconds = 0.5 // DEPRICATED
                 # Do not compress assets
                 config.assets.compress = false
                 # Expands the lines which load the assets
                 config.assets.debug = true
                 # Prevents assets from rendering twice

config/environments/test.rb ¶ +1 -1

                 # Raise exceptions instead of rendering exception templates
                 config.action_dispatch.show_exceptions = false
                 # Disable request forgery protection in test environment
                 config.action_controller.allow_forgery_protection    = false
                 # Tell Action Mailer not to deliver emails to the real world.
                 # The :test delivery method accumulates sent emails in the
                 # ActionMailer::Base.deliveries array.
                 config.action_mailer.delivery_method = :test
                 # Raise exception on mass assignment protection for Active Record models
-            -   config.active_record.mass_assignment_sanitizer = :strict
+            +   #config.active_record.mass_assignment_sanitizer = :strict // DEPRICATED
                 # Print deprecation notices to the stderr
                 config.active_support.deprecation = :stderr
                 config.eager_load = false
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r617:f062e467ef5c - Mon, 28 Nov 2016 10:31:29 - 10 files changed: 42 inserted, 63 deleted

Sign in to your account

Commit r617:f062e467ef5c public

Author

r617:f062e467ef5c - Mon, 28 Nov 2016 10:31:29 - 10 files changed: 42 inserted, 63 deleted

Commit `r617:f062e467ef5c` public