htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid that files from other exercises can be created

Browse Source
This commit is contained in:
tobias.kantusch
2021-04-22 16:56:56 +02:00
committed by Sebastian Serth
parent 1f3c9db537
commit caaa52409e
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/concerns/file_parameters.rb
View File

@ -5,7 +5,8 @@ module FileParameters
if Exercise.exists?(id: exercise_id) && params if Exercise.exists?(id: exercise_id) && params
params.reject do |_, file_attributes| params.reject do |_, file_attributes|
file = CodeOcean::File.find_by(id: file_attributes[:file_id]) file = CodeOcean::File.find_by(id: file_attributes[:file_id])
file.nil? || file.hidden || file.read_only # avoid that public files from other contexts can be created
file.nil? || file.hidden || file.read_only || file.context_id != exercise_id.to_i
end end
else else
[] []

2
app/controllers/concerns/submission_parameters.rb
View File

@ -9,7 +9,7 @@ module SubmissionParameters
# The study_group_id might not be present in the session (e.g. for internal users), resulting in session[:study_group_id] = nil which is intended. # The study_group_id might not be present in the session (e.g. for internal users), resulting in session[:study_group_id] = nil which is intended.
submission_params = params[:submission].present? ? params[:submission].permit(:cause, :exercise_id, files_attributes: file_attributes).merge(user_id: current_user_id, user_type: current_user_class_name, study_group_id: session[:study_group_id]) : {} submission_params = params[:submission].present? ? params[:submission].permit(:cause, :exercise_id, files_attributes: file_attributes).merge(user_id: current_user_id, user_type: current_user_class_name, study_group_id: session[:study_group_id]) : {}
files_attributes = submission_params[:files_attributes] || [] files_attributes = submission_params[:files_attributes] || []
submission_params[:files_attributes] = reject_illegal_file_attributes(submission_params[:exercise_id], files_attributes) submission_params[:files_attributes] = reject_illegal_file_attributes(submission_params[:exercise_id].to_i, files_attributes)
submission_params submission_params
end end
private :submission_params private :submission_params