Pull request for Mass Assignment - Team Ruby Racer

.travis.yml

@@ -24,8 +24,11 @@ env:
 notifications:
   email:
     recipients:
-      - [email protected]
-      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
     # on_success: [always|never|change] # default: change
     # on_failure: [always|never|change] # default: always
     on_success: change

Gemfile

@@ -68,6 +68,7 @@ end
 group :development, :test do
   gem 'launchy'
   gem 'taps'
+
 #  gem 'rake'
 
   # see this link for details on which gem to install for debugger
@@ -93,6 +94,8 @@ group :development, :test do
 #  gem 'autotest-growl' if RUBY_PLATFORM =~ /darwin/
 
 #  gem 'test-unit' #, '1.2.3' #Downgrading so that autotest, rspec will work
+  # gem for strong parameters
+  gem 'strong_parameters', '0.2.1'
 end
 
 

Gemfile.lock

@@ -242,6 +242,10 @@ GEM
       rack (>= 1.0)
     spreadsheet (0.8.3)
       ruby-ole (>= 1.0)
+    strong_parameters (0.2.1)
+      actionpack (~> 3.0)
+      activemodel (~> 3.0)
+      railties (~> 3.0)
     taps (0.3.24)
       rack (>= 1.0.1)
       rest-client (>= 1.4.0, < 1.7.0)
@@ -309,6 +313,7 @@ DEPENDENCIES
   seedbank
   shoulda
   spreadsheet
+  strong_parameters (= 0.2.1)
   taps
   thin
   vestal_versions!

app/controllers/application_controller.rb

@@ -49,11 +49,10 @@ def current_person
     end
   end
 
-##  In development, if you want to pretend to be a different user, you can set it easily here
-#  def current_user
-#    User.find_by_id 725 #Cecile
-##    User.last
-#  end
+  ##  In development, if you want to pretend to be a different user, you can set it easily here
+  #def current_user
+  #  User.find_by_id 1
+  #end
 
   def authenticate_user!
     if !current_user

app/controllers/courses_controller.rb

@@ -9,7 +9,6 @@ def index
     @all_courses = true
     @courses = Course.order("year DESC, semester DESC, number ASC").all
     @courses = @courses.sort_by { |c| -c.sortable_value } # note the '-' is for desc sorting
-
     @registered_for_these_courses_during_current_semester = current_person.registered_for_these_courses_during_current_semester
     @teaching_these_courses_during_current_semester = current_person.teaching_these_courses_during_current_semester
   end
@@ -129,7 +128,7 @@ def create
     authorize! :create, Course
     @last_offering = Course.last_offering(params[:course][:number])
     if @last_offering.nil?
-      @course = Course.new(:name => "New Course", :mini => "Both", :number => params[:course][:number])
+      @course = Course.new(course_params)
     else
       @course = @last_offering.copy_as_new_course
     end
@@ -140,7 +139,6 @@ def create
     respond_to do |format|
       @course.updated_by_user_id = current_user.id if current_user
       if @course.save
-
         flash[:notice] = 'Course was successfully created.'
         format.html { redirect_to edit_course_path(@course) }
         format.xml { render :xml => @course, :status => :created, :location => @course }
@@ -164,10 +162,11 @@ def update
       @course.configured_by_user_id = current_user.id
     end
 
+    params.permit(:teachers => [])
     params[:course][:faculty_assignments_override] = params[:teachers]
     respond_to do |format|
       @course.updated_by_user_id = current_user.id if current_user
-      @course.attributes = params[:course]
+      @course.attributes = course_params
       if @course.save
         flash[:notice] = 'Course was successfully updated.'
         format.html { redirect_back_or_default(course_path(@course)) }
@@ -250,4 +249,9 @@ def index_core
       format.xml { render :xml => @courses }
     end
   end
+
+  def course_params
+      params.require(:course).permit(:number,:name,:short_name,:semester,:mini, :year)
+  end
+
 end

app/controllers/deliverables_controller.rb

@@ -1,5 +1,4 @@
 class DeliverablesController < ApplicationController
-
   layout 'cmu_sv'
 
   before_filter :authenticate_user!
@@ -26,8 +25,36 @@ def grading_queue_for_course
       flash.now[:error] = I18n.t(:default_grading_rule_for_course)
     end
 
+    # This will be used for the 'Assignments including' select one box
+    @assignments = Assignment.fetch_submittable_assignments_by_course_id @course.id
+
     if (current_user.is_admin? || @course.faculty.include?(current_user))
-      @deliverables = Deliverable.where(:course_id => @course.id).all
+      # By Default fetch data for my teams
+      team_selection = 1 # MY_TEAMS
+
+      # Check what the session value is ::
+      if( session[:team_selection] != nil )
+        team_selection = session[:team_selection]
+        #puts ">>> Team selection used from session preference: #{team_selection}"
+      end
+
+      # Remember that user selection overrides the session preference
+      if params[:teams] == "all_teams"
+        team_selection = 2 # ALL_TEAMS
+      end
+      if params[:teams] == 'my_teams'
+        team_selection = 1 # MY_TEAMS
+      end
+
+      # For future requests save this preference back in the session variable
+      session[:team_selection] = team_selection
+      #puts "<<< Team selection: #{team_selection} set to session as preference"
+
+      @team_deliverables = Deliverable.team_deliverables_for_grading_queue(@course, current_user, team_selection)
+      @individual_deliverables = Deliverable.individual_deliverables_for_grading_queue(@course, current_user, team_selection)
+
+      # Return all team deliverables and Individual deliverables for the current course in 1 object
+      @deliverables = [@team_deliverables.to_a, @individual_deliverables.to_a].flatten
     else
       has_permissions_or_redirect(:admin, root_path)
     end
@@ -108,6 +135,8 @@ def new
     @deliverable = Deliverable.new(:creator => current_user)
     @courses = current_user.registered_for_these_courses_during_current_semester
 
+    # permitting parameters to protect against mass assignment
+    params.permit(:course_id)
     if params[:course_id]
       @deliverable.course_id = params[:course_id]
       @assignments = Course.find(params[:course_id]).assignments.where(:is_submittable => true)
@@ -142,8 +171,9 @@ def edit
   # POST /deliverables
   # POST /deliverables.xml
   def create
+
     # Make sure that a file was specified
-    @deliverable = Deliverable.new(params[:deliverable])
+    @deliverable = Deliverable.new(deliverable_params)
     @deliverable.creator = current_user
     @deliverable.is_team_deliverable ? @deliverable.update_team : @deliverable.team = nil
 
@@ -164,7 +194,7 @@ def create
       end
       return
     end
-    @attachment = DeliverableAttachment.new(params[:deliverable_attachment])
+    @attachment = DeliverableAttachment.new(deliverable_attachment_params)
     @attachment.submitter = @deliverable.creator
     @deliverable.attachment_versions << @attachment
     @attachment.deliverable = @deliverable
@@ -205,20 +235,20 @@ def update
     there_is_an_attachment = params[:deliverable_attachment][:attachment]
     if there_is_an_attachment
 
-      @attachment = DeliverableAttachment.new(params[:deliverable_attachment])
+      @attachment = DeliverableAttachment.new(deliverable_attachment_params)
       @attachment.submitter = current_user
       @deliverable.attachment_versions << @attachment
       @attachment.deliverable = @deliverable
 
-      if @attachment.valid? and @deliverable.valid? and @deliverable.update_attributes(params[:deliverable])
+      if @attachment.valid? and @deliverable.valid? and @deliverable.update_attributes(deliverable_params)
         @deliverable.send_deliverable_upload_email(url_for(@deliverable))
         flash[:notice] = 'Deliverable was successfully updated.'
         redirect_to(@deliverable)
       else
         render :action => "edit"
       end
     else
-      if @deliverable.valid? and @deliverable.update_attributes(params[:deliverable])
+      if @deliverable.valid? and @deliverable.update_attributes(deliverable_params)
         flash[:notice] = 'Deliverable was successfully updated.'
         redirect_to(@deliverable)
       else
@@ -289,14 +319,14 @@ def update_feedback
     end
 
     respond_to do |format|
-       if flash[:error].blank?
-         flash[:error] = nil
-         flash[:notice] = 'Feedback successfully saved.'
-         format.html {redirect_to(course_deliverables_path(@deliverable.course))}
-       else
-         flash[:error] = flash[:error].join("<br>")
-         format.html { redirect_to(@deliverable) }
-       end
+      if flash[:error].blank?
+        flash[:error] = nil
+        flash[:notice] = 'Feedback successfully saved.'
+        format.html {redirect_to(course_deliverables_path(@deliverable.course))}
+      else
+        flash[:error] = flash[:error].join("<br>")
+        format.html { redirect_to(@deliverable) }
+      end
     end
   end
 
@@ -313,4 +343,14 @@ def get_assignments_for_student
     end
   end
 
+  private
+  # Permitted params
+  def deliverable_params
+    params.require(:deliverable).permit(:assignment_id,:course_id)
+  end
+
+  def deliverable_attachment_params
+    params.require(:deliverable_attachment).permit(:comment,:attachment)
+  end
+
 end

app/controllers/teams_controller.rb

@@ -181,8 +181,9 @@ def edit
   # POST /courses/1/teams.xml
   def create
     if has_permissions_or_redirect(:staff, root_path)
+      params.permit(:persons => [])
       params[:team][:members_override] = params[:persons]
-      @team = Team.new(params[:team])
+      @team = Team.new(team_params)
 
       @team.course_id = params[:course_id]
       @course = Course.find(params[:course_id])
@@ -214,7 +215,7 @@ def update
       update_course_faculty_label
 
       respond_to do |format|
-        @team.attributes = params[:team]
+        @team.attributes = team_params
         if @team.save(params[:team])
           flash[:notice] = 'Team was successfully updated.'
           format.html { redirect_to(course_teams_path(@team.course)) }
@@ -291,11 +292,18 @@ def peer_evaluation_update
 
 
   def update_course_faculty_label
+    params.permit(:primary_faculty_lable,:secondary_faculty_label)
     @course = Course.find(params[:course_id])
     if @course.primary_faculty_label != params[:primary_faculty_label] || @course.secondary_faculty_label != params[:seconday_faculty_label] then
       @course.primary_faculty_label = params[:primary_faculty_label]
       @course.secondary_faculty_label = params[:secondary_faculty_label]
       @course.save
     end
   end
+
+  private
+
+  def team_params
+      params.require(:team).permit(:name,:section,:primary_faculty_id,:secondary_faculty_id,:email)
+  end
 end

app/models/assignment.rb

@@ -127,4 +127,8 @@ def set_due_date date, hour, minute
     self.due_date = "#{self.date} #{self.hour}:#{self.minute}"
   end
 
+  def self.fetch_submittable_assignments_by_course_id course_id
+    Assignment.where(:course_id => course_id, :is_submittable => 't').order('id ASC')
+  end
+
 end

app/models/course.rb

@@ -30,6 +30,7 @@
 # Course has grading rules. These include grading cut_offs for grade's like A,A-,B+ etc.
 
 class Course < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
   has_many :teams
   belongs_to :course_number
   has_many :pages, :order => "position"

app/models/deliverable.rb

@@ -34,6 +34,7 @@
 
 
 class Deliverable < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
   belongs_to :team
   belongs_to :course
 
@@ -334,4 +335,23 @@ def inaccurate_course_and_assignment_check
       end
     end
   end
+
+  # This method fetches team deliverables for the specified course and filter selections
+  def self.team_deliverables_for_grading_queue(course, current_user, team_selection)
+    sql_query = DeliverableQueryHelper.generate_query_for_team_deliverables(course, current_user, team_selection)
+    return execute_custom_sql(sql_query)
+  end
+
+  # This method fetches individual deliverables for the specified course and filter selections
+  def self.individual_deliverables_for_grading_queue(course, current_user, team_selection)
+    sql_query = DeliverableQueryHelper.generate_query_for_individual_deliverables(course, current_user, team_selection)
+    return execute_custom_sql(sql_query)
+  end
+
+  # This is a utility method to execute a fully formed custom SQL query
+  def self.execute_custom_sql(sql_query_str)
+    sql = self.sanitize_sql([sql_query_str])
+
+    return self.connection.execute(sql)
+  end
 end

app/models/deliverable_attachment.rb

@@ -1,4 +1,5 @@
 class DeliverableAttachment < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
   set_table_name "deliverable_attachment_versions"
 
   belongs_to :submitter, :class_name => "User", :foreign_key => "submitter_id"