atomaka/MSU-Course-Alerter
1
0
Fork 0
Code Releases Activity

Autofill user_id; editing still vulnerable

Browse source
This commit is contained in:
Andrew Tomaka 2013-04-06 12:25:31 -04:00
parent f463c66eff
commit 829aecfce3
3 changed files with 5 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
app/controllers/alerts_controller.rb
View file

@ -40,6 +40,7 @@ class AlertsController < ApplicationController
# POST /alerts.json # POST /alerts.json
def create def create
@alert = Alert.new(params[:alert]) @alert = Alert.new(params[:alert])
@alert.user_id = current_user.id
respond_to do |format| respond_to do |format|
if @alert.save if @alert.save

8
app/models/alert.rb
View file

@ -17,10 +17,10 @@ class Alert < ActiveRecord::Base
:format => { :format => {
:with => /\A[0-9]+[A-Za-z]?\Z/ :with => /\A[0-9]+[A-Za-z]?\Z/
} }
validates :user_id, :presence => true, # validates :user_id, :presence => true,
:numericality => { # :numericality => {
only_integer: true # only_integer: true
} # }
validates :semester, :presence => true validates :semester, :presence => true
scope :user_alerts, lambda { |user_id| scope :user_alerts, lambda { |user_id|

12
app/views/alerts/_form.html.erb
View file

@ -1,10 +1,4 @@
<%= form_for @alert, :html => { :class => 'form-horizontal' } do |f| %> <%= form_for @alert, :html => { :class => 'form-horizontal' } do |f| %>
<div class="control-group">
<%= f.label :user_id, :class => 'control-label' %>
<div class="controls">
<%= f.number_field :user_id, :class => 'number_field' %>
</div>
</div>
<div class="control-group"> <div class="control-group">
<%= f.label :department, :class => 'control-label' %> <%= f.label :department, :class => 'control-label' %>
<div class="controls"> <div class="controls">
@ -23,12 +17,6 @@
<%= f.text_field :semester, :class => 'text_field' %> <%= f.text_field :semester, :class => 'text_field' %>
</div> </div>
</div> </div>
<div class="control-group">
<%= f.label :alerted, :class => 'control-label' %>
<div class="controls">
<%= f.check_box :alerted, :class => 'check_box' %>
</div>
</div>
<div class="form-actions"> <div class="form-actions">
<%= f.submit nil, :class => 'btn btn-primary' %> <%= f.submit nil, :class => 'btn btn-primary' %>