Mass assignment

.gitignore

@@ -2,6 +2,8 @@
 db/*.sqlite3
 log/*.log
 tmp/
+*.swp
+tmpdir/
 
 .gems
 20090827190915_mfse_add_people.rb

.travis.yml

@@ -29,4 +29,4 @@ notifications:
     # on_success: [always|never|change] # default: change
     # on_failure: [always|never|change] # default: always
     on_success: change
-    on_failure: always
+    on_failure: always

Gemfile

@@ -95,6 +95,6 @@ group :development, :test do
 #  gem 'test-unit' #, '1.2.3' #Downgrading so that autotest, rspec will work
 end
 
-
+gem 'strong_parameters'
 
 #gem 'gchartrb'

Gemfile.lock

@@ -242,6 +242,10 @@ GEM
       rack (>= 1.0)
     spreadsheet (0.8.3)
       ruby-ole (>= 1.0)
+    strong_parameters (0.2.1)
+      actionpack (~> 3.0)
+      activemodel (~> 3.0)
+      railties (~> 3.0)
     taps (0.3.24)
       rack (>= 1.0.1)
       rest-client (>= 1.4.0, < 1.7.0)
@@ -309,6 +313,7 @@ DEPENDENCIES
   seedbank
   shoulda
   spreadsheet
+  strong_parameters
   taps
   thin
   vestal_versions!

app/controllers/application_controller.rb

@@ -50,10 +50,12 @@ def current_person
   end
 
 ##  In development, if you want to pretend to be a different user, you can set it easily here
-#  def current_user
-#    User.find_by_id 725 #Cecile
-##    User.last
-#  end
+  #def current_user
+    #User.find_by_id 725 #Cecile
+    #User.last
+    #User.find_by_twiki_name("EdKatz")
+    #User.find_by_human_name "Todd Sedano"
+  #end
 
   def authenticate_user!
     if !current_user

app/controllers/effort_log_line_items_controller.rb

@@ -50,7 +50,7 @@ def edit
   # POST /effort_log_line_items
   # POST /effort_log_line_items.xml
   def create
-    @effort_log_line_item = EffortLogLineItem.new(params[:effort_log_line_item])
+    @effort_log_line_item = EffortLogLineItem.new(elli_params)
 
     respond_to do |format|
       if @effort_log_line_item.save
@@ -70,7 +70,7 @@ def update
     @effort_log_line_item = EffortLogLineItem.find(params[:id])
 
     respond_to do |format|
-      if @effort_log_line_item.update_attributes(params[:effort_log_line_item])
+      if @effort_log_line_item.update_attributes(elli_params)
         flash[:notice] = 'EffortLogLineItem was successfully updated.'
         format.html { redirect_to(@effort_log_line_item) }
         format.xml { head :ok }
@@ -97,4 +97,10 @@ def destroy
   def redirect_to_effort_log_index
     redirect_to :controller => :effort_logs, :action => :index
   end
+
+  private
+  def elli_params
+    params.require(:effort_log_line_items).permit(:day1, :day2, :day3, :day4, :day5, :day6, :day7)
+  end
+
 end

app/controllers/effort_logs_controller.rb

@@ -310,7 +310,7 @@ def edit
   # POST /effort_logs
   # POST /effort_logs.xml
   def create
-    @effort_log = EffortLog.new(params[:effort_log])
+    @effort_log = EffortLog.new(effort_log_params)
 
     setup_required_datastructures(@effort_log.year, @effort_log.week_number)
 
@@ -349,7 +349,7 @@ def update
     setup_required_datastructures(@effort_log.year, @effort_log.week_number)
 
     respond_to do |format|
-      if @effort_log.update_attributes(params[:effort_log])
+      if @effort_log.update_attributes(effort_log_params)
         #check to see if user is logging effort for unregistered courses
         course_error_msg = @effort_log.validate_effort_against_registered_courses()
         flash[:notice] = 'EffortLog was successfully updated.'
@@ -424,5 +424,9 @@ def recent_foundations_or_course
     Course.order("id DESC").first
   end
 
+  private
+  def effort_log_params
+    params.require(:effort_log).permit(:user_id, :week_number, :year)
+  end
 
 end

app/controllers/jobs_controller.rb

@@ -27,8 +27,9 @@ def edit
   # POST /jobs
   def create
     authorize! :create, Job
-    params[:job][:supervisors_override] = params[:supervisors]
-    params[:job][:employees_override] = params[:students]
+    params[:job][:supervisors_override] = supervisors_params
+    params[:job][:employees_override] = []
+    params[:job][:employees_override] = students_params if params[:students]
     @job = Job.new(params[:job])
     @projects = SponsoredProject.current
 
@@ -44,8 +45,9 @@ def create
   # PUT /jobs/1
   # PUT /jobs/1.xml
   def update
-    params[:job][:supervisors_override] = params[:supervisors]
-    params[:job][:employees_override] = params[:students]
+    params[:job][:supervisors_override] = supervisors_params
+    params[:job][:employees_override] = []
+    params[:job][:employees_override] = students_params if params[:students]
     @job = Job.find(params[:id])
     authorize! :update, @job
     if  params[:job][:is_closed].present? && params[:job][:is_closed] == "true"
@@ -67,5 +69,22 @@ def assignments
     @jobs = Job.active
     @all_employees = Job.all_employees
   end
+
+  private
+    def supervisors_params
+      params.require(:supervisors)
+    end
+
+    def supervisor_params(supervisor)
+      supervisor.permit(:people_name)
+    end
+
+    def students_params
+      params.require(:students)
+    end
+
+    def student_params(student)
+      student.permit(:people_name)
+    end
 
 end

app/models/effort_log.rb

@@ -1,4 +1,6 @@
 class EffortLog < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
+
   has_many :effort_log_line_items, :dependent => :destroy
   belongs_to :user
 

app/models/effort_log_line_item.rb

@@ -1,4 +1,5 @@
 class EffortLogLineItem < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
   acts_as_list :scope => :effort_log
 
   belongs_to :effort_log

app/models/job_employee.rb

@@ -1,4 +1,6 @@
 class JobEmployee < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
+
   belongs_to :job
   belongs_to :user
   delegate :human_name, :to => :user

app/models/job_supervisor.rb

@@ -1,4 +1,6 @@
 class JobSupervisor < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
+
   belongs_to :job
   belongs_to :user
   delegate :human_name, :to => :user

app/models/peer_evaluation_learning_objective.rb

@@ -1,2 +1,3 @@
 class PeerEvaluationLearningObjective < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
 end

app/models/peer_evaluation_report.rb

@@ -1,4 +1,5 @@
 class PeerEvaluationReport < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
 
   def self.emailed_on(team_id)
     report = PeerEvaluationReport.where(:team_id => team_id).first

app/models/peer_evaluation_review.rb

@@ -28,6 +28,7 @@
 # and integrated by Todd Sedano. Student teams can provide 360 review feedback
 # when prompted by the faculty.
 class PeerEvaluationReview < ActiveRecord::Base
+  include ActiveModel::ForbiddenAttributesProtection
 
   belongs_to :team
   belongs_to :author, :class_name => "User"

app/views/deliverables/_deliverable_listing_professor.html.erb

@@ -66,3 +66,4 @@
       </tr>
   <% end %>
 </table>
+

app/views/deliverables/grading_queue_for_course.html.erb

@@ -92,4 +92,4 @@
       </div>
 
       <%= render :partial => "deliverable_listing_professor", :locals => {:deliverables => @deliverables, :skip_course_column => true} %>
-      <br/>
+      <br/>

app/views/deliverables/index.html.erb

@@ -2,7 +2,7 @@
 
 <% if current_user.is_staff %>
     <div class="staff"><p>Note that this view is intended for students. To find deliverables submitted for a course,
-      first select the course and then pick "deliverabes.
+      first select the course and then pick "deliverables.
       See" <%= link_to "My courses", my_courses_path(current_user) %></p></div>
 <% end %>
 

config/initializers/session_store.rb

@@ -1,6 +1,6 @@
-# Be sure to restart your server when you modify this file.
+	# Be sure to restart your server when you modify this file.
 
-CMUEducation::Application.config.session_store :cookie_store, :key => '_CMUEducation_session'
+CMUEducation::Application.config.session_store :active_record_store
 
 # Use the database for sessions instead of the cookie-based default,
 # which shouldn't be used to store highly confidential information

db/schema.rb

@@ -458,6 +458,16 @@
 
   add_index "scotty_dog_sayings", ["user_id"], :name => "index_scotty_dog_sayings_on_user_id"
 
+  create_table "sessions", :force => true do |t|
+    t.string   "session_id", :null => false
+    t.text     "data"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+  end
+
+  add_index "sessions", ["session_id"], :name => "index_sessions_on_session_id"
+  add_index "sessions", ["updated_at"], :name => "index_sessions_on_updated_at"
+
   create_table "sponsored_project_allocations", :force => true do |t|
     t.integer  "sponsored_project_id"
     t.integer  "user_id"

db/seeds.rb

@@ -130,4 +130,3 @@
 FactoryGirl.create(:presentation_feedback_questions, :label => "Visuals", :text => "Were they well-designed? Were all of them readable? Were they helpful? Were they manipulated well?")
 FactoryGirl.create(:presentation_feedback_questions, :label => "Delivery", :text => "Bodily delivery: (eye-contact, gestures, energy)    Vocal delivery: (loudness, rate, articulation) Question handling (poise, tact, team support; did the team answer the question asked?)")
 
-

db/seeds/development/dda.seeds.rb

@@ -75,10 +75,10 @@
 assignment = Assignment.find_by_name("Patronous Charm")
 team.members.each do |member|
   grade = Grade.get_grade(course_dda.id, assignment.id, member.id)
-  grade.destroy
+  grade.destroy if grade
 end
 
 deliverable = Deliverable.find_by_assignment_id_and_team_id(assignment.id, team.id)
 attachment = FactoryGirl.create(:deliverable_attachment, :deliverable_id=>deliverable.id, :submitter_id=>team.members.first.id, :attachment_file_name=>"#{team.name}_old_file", :submission_date=>Time.now)
 attachment.submission_date = assignment.due_date
-attachment.save
+attachment.save

db/seeds/development/jobs.seeds.rb

@@ -11,7 +11,7 @@
   ],
   [
     "An Interchange Ontology for Mobile Sensor Platforms in Home Health Management",
-    %q(This project is in year 2 of a 3-year grant, and concerns the application of ontological engineering methods to the use of mobile sensor platforms in the home health management domain. To date we have defined a simple ontology and a mapping to a standard (IEEE 11073) for exchanging health monitoring data, such as blood pressure, pulse rate, temperature, etc. This year we will explore two tasks: 1.    Building a proof of concept smart phone app that automatically converts health monitoring data into IEEE 11073-compatible form using the ontology, 2.    Apply automated reasoning techniques to validate portions of the IEEE 11073 standard after converting it into an OWLrepresentation.),
+    %q(This project is in year 2 of a 3-year grant, and concerns the application of ontological engineering methods to the use of mobile sensor platforms in the home health management domain. To date we have defined a simple ontology and a mapping to a standard (IEEE 11073) for exchanging health monitoring data, such as blood pressure, pulse rate, temperature, etc. This year we will explore two tasks: 1. Building a proof of concept smart phone app that automatically converts health monitoring data into IEEE 11073-compatible form using the ontology, 2. Apply automated reasoning techniques to validate portions of the IEEE 11073 standard after converting it into an OWLrepresentation.),
     "Experience with mobile device app development",
      "some experience with Semantic Web technology (RDF, OWL, SPARQL) would be preferred",
      " Fall, Spring and Summer semesters, 10 hours per week. Would like a commitment for the full year",
@@ -34,4 +34,4 @@
       :duration => job[4],
       :is_closed => job[8]
     )
-  end
+  end

db/seeds/development/req.seeds.rb

@@ -154,10 +154,10 @@
 assignment_validation = Assignment.find_by_name("Elaboration and Validation")
 team_cooper.members.each do |member|
   grade = Grade.get_grade(course_req.id, assignment_validation.id, member.id)
-  grade.destroy
+  grade.destroy if grade
 end
 
 deliverable = Deliverable.find_by_assignment_id_and_team_id(assignment_validation.id, team_cooper.id)
 attachment = FactoryGirl.create(:deliverable_attachment, :deliverable_id=>deliverable.id, :submitter_id=>team_cooper.members.first.id, :attachment_file_name=>"#{team_cooper.name}_old_file", :submission_date=>Time.now)
 attachment.submission_date = assignment_validation.due_date
-attachment.save
+attachment.save

db/seeds/development/seeds_helper.rb

@@ -14,11 +14,13 @@ def set_up_course(course)
       course.teams.each do |team|
         deliverable=FactoryGirl.create(:team_deliverable_simple, :team_id=>team.id, :creator_id=>team.members.first.id, :course_id=>course.id, :assignment_id=>assignment.id)
         FactoryGirl.create(:deliverable_attachment, :deliverable_id=>deliverable.id, :submitter_id=>team.members.first.id, :attachment_file_name=>"#{team.name}_new_file", :submission_date=>Time.now)
-        score = 1+Random.rand(assignment.maximum_score)
-        team.members.each do |member|
-          grade = FactoryGirl.create(:grade_points, :course_id=>course.id, :assignment => assignment, :student_id => member.id, :is_student_visible => true)
-          grade.score = score
-          grade.save
+        if Random.rand > 0.5
+          score = 1+Random.rand(assignment.maximum_score)
+          team.members.each do |member|
+            grade = FactoryGirl.create(:grade_points, :course_id=>course.id, :assignment => assignment, :student_id => member.id, :is_student_visible => true)
+            grade.score = score
+            grade.save
+          end
         end
       end
     elsif assignment.is_submittable
@@ -31,4 +33,4 @@ def set_up_course(course)
       end
     end
   end
-end
+end

spec/controllers/effort_logs_controller_spec.rb

@@ -42,8 +42,8 @@
 
       context "and there are effort logs" do
         before do
-          @effort_logs = [EffortLog.new(:year => 2011, :week_number => 12, :sum => 8),
-                          EffortLog.new(:year => 2011, :week_number => 12, :sum => 8)]
+          @effort_logs = [EffortLog.new(:year => 2011, :week_number => 12),
+                          EffortLog.new(:year => 2011, :week_number => 12)]
           EffortLog.stub(:find_effort_logs).and_return(@effort_logs)
         end
 
@@ -81,8 +81,8 @@
 
       context "and there are effort logs" do
         before do
-          @effort_logs = [EffortLog.new(:year => 2011, :week_number => 12, :sum => 8),
-                          EffortLog.new(:year => 2011, :week_number => 12, :sum => 8)]
+          @effort_logs = [EffortLog.new(:year => 2011, :week_number => 12),
+                          EffortLog.new(:year => 2011, :week_number => 12)]
           EffortLog.stub(:find_effort_logs).and_return(@effort_logs)
         end
 
@@ -221,4 +221,4 @@
     end
 
   end
-end
+end

spec/models/effort_log_line_item_spec.rb

@@ -47,5 +47,4 @@
         end
       end
     end
-
   end

spec/models/effort_log_model_spec.rb

@@ -163,5 +163,4 @@
     end
   end
 
-
 end

spec/models/peer_evaluation_review_spec.rb

@@ -11,6 +11,5 @@
     PeerEvaluationReview.is_completed_for?(nil, nil).should be_false
   end
 
-
 end
 

spec/requests/deliverables_spec.rb

@@ -142,7 +142,7 @@
         login_with_oauth @professor
         # visit deliverable_feedback_path(Deliverable.last)  #if we separate out the feedback page
         visit deliverable_path(Deliverable.last)
-        save_and_open_page
+        #save_and_open_page
         page.should have_content("Grade Team Deliverable")
       }