Properly reject invalid ActionCable subscriptions

Previously, we were not properly rejecting the submission, so that the channel name was still evaluated (leading to errors). Now, we handle these cases as well.

Fixes CODEOCEAN-V2
This commit is contained in:
Sebastian Serth
2023-09-30 17:22:27 +02:00
parent 42b0507cd6
commit 2f97c0357c
3 changed files with 52 additions and 20 deletions

View File

@@ -3,7 +3,8 @@
class PgMatchingChannel < ApplicationCable::Channel
def subscribed
set_and_authorize_exercise
stream_from specific_channel
stream_from specific_channel unless subscription_rejected?
end
def unsubscribed
@@ -13,10 +14,6 @@ class PgMatchingChannel < ApplicationCable::Channel
stop_all_streams
end
def specific_channel
"pg_matching_channel_exercise_#{@exercise.id}"
end
def waiting_for_match
@current_waiting_user = PairProgrammingWaitingUser.find_or_initialize_by(user: current_user, exercise: @exercise)
@current_waiting_user.status_waiting!
@@ -40,8 +37,14 @@ class PgMatchingChannel < ApplicationCable::Channel
ActionCable.server.broadcast(specific_channel, {action: 'joined_pg', users: pg.users.map(&:to_page_context)})
end
def specific_channel
"pg_matching_channel_exercise_#{@exercise.id}"
end
def set_and_authorize_exercise
@exercise = Exercise.find(params[:exercise_id])
reject unless ExercisePolicy.new(current_user, @exercise).implement?
rescue ActiveRecord::RecordNotFound
reject
end
end