htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cleanup of passed parameters, user_id and user_type are extracted from current user and not used from the passed POST values..

Browse Source
This commit is contained in:
Ralf Teusner
2015-08-19 15:35:25 +02:00
parent e520914385
commit dc0b3a2294
3 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/assets/javascripts/editor.js
View File

@ -510,7 +510,6 @@ $(function() {
var jqxhr = $.ajax({ var jqxhr = $.ajax({
data: { data: {
comment: { comment: {
user_id: user_id,
file_id: file_id, file_id: file_id,
row: row, row: row,
column: 0, column: 0,
@ -1014,7 +1013,6 @@ $(function() {
url: '/request_for_comments', url: '/request_for_comments',
data: { data: {
request_for_comment: { request_for_comment: {
requestor_user_id: user_id,
exercise_id: exercise_id, exercise_id: exercise_id,
file_id: file_id, file_id: file_id,
"requested_at(1i)": 2015, // these are the timestamp values that the request handler demands "requested_at(1i)": 2015, // these are the timestamp values that the request handler demands

4
app/controllers/comments_controller.rb
View File

@ -75,7 +75,7 @@ class CommentsController < ApplicationController
# POST /comments # POST /comments
# POST /comments.json # POST /comments.json
def create def create
@comment = Comment.new(comment_params.merge(user_type: current_user.class.name)) @comment = Comment.new(comment_params)
respond_to do |format| respond_to do |format|
if @comment.save if @comment.save
@ -135,6 +135,6 @@ class CommentsController < ApplicationController
def comment_params def comment_params
#params.require(:comment).permit(:user_id, :file_id, :row, :column, :text) #params.require(:comment).permit(:user_id, :file_id, :row, :column, :text)
# fuer production mode, damit böse menschen keine falsche user_id uebergeben: # fuer production mode, damit böse menschen keine falsche user_id uebergeben:
params.require(:comment).permit(:file_id, :row, :column, :text).merge(user_id: current_user.id) params.require(:comment).permit(:file_id, :row, :column, :text).merge(user_id: current_user.id, user_type: current_user.class.name)
end end
end end

2
app/controllers/request_for_comments_controller.rb
View File

@ -66,6 +66,6 @@ class RequestForCommentsController < ApplicationController
# Never trust parameters from the scary internet, only allow the white list through. # Never trust parameters from the scary internet, only allow the white list through.
def request_for_comment_params def request_for_comment_params
params.require(:request_for_comment).permit(:requestor_user_id, :exercise_id, :file_id, :requested_at) params.require(:request_for_comment).permit(:exercise_id, :file_id, :requested_at).merge(requestor_user_id: current_user.id, user_type: current_user.class.name)
end end
end end