Files
codeocean/app/channels/la_exercises_channel.rb
Sebastian Serth 2f97c0357c Properly reject invalid ActionCable subscriptions
Previously, we were not properly rejecting the submission, so that the channel name was still evaluated (leading to errors). Now, we handle these cases as well.

Fixes CODEOCEAN-V2
2023-09-30 18:56:19 +02:00

35 lines
858 B
Ruby

# frozen_string_literal: true
class LaExercisesChannel < ApplicationCable::Channel
def subscribed
set_and_authorize_exercise
set_and_authorize_study_group
stream_from specific_channel unless subscription_rejected?
end
def unsubscribed
stop_all_streams
end
private
def specific_channel
"la_exercises_#{@exercise.id}_channel_study_group_#{@study_group.id}"
end
def set_and_authorize_exercise
@exercise = Exercise.find(params[:exercise_id])
reject unless ExercisePolicy.new(current_user, @exercise).implement?
rescue ActiveRecord::RecordNotFound
reject
end
def set_and_authorize_study_group
@study_group = @exercise.study_groups.find(params[:study_group_id])
reject unless StudyGroupPolicy.new(current_user, @study_group).stream_la?
rescue ActiveRecord::RecordNotFound
reject
end
end