Redstoner/redstoner.com
Archived
0
Fork 0
Code Issues Pull Requests 2 Wiki Activity

security, user index

Browse Source
This commit is contained in:
jomo
2013-06-24 16:49:58 +02:00
parent b4f2dc5fab
commit c5dfdbeb8f
13 changed files with 125 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
app/assets/stylesheets/screen.css.scss
View File

@@ -265,5 +265,41 @@ and (min-width: 1000px)
} }
} }
#userlist {
.list-user {
margin: 5px 0;
display: block;
a {
color: $midgrey;
display: inline-block;
&:hover {
color: $darkred;
}
}
img {
float: left;
}
.user-info {
margin: 10px;
float: left;
span {
display: block;
}
.user-name {
font-weight: bold;
}
.user-ign {
color: #888;
font-style: italic;
}
}
}
}
} }

47
app/controllers/blogposts_controller.rb
View File

@@ -10,20 +10,26 @@ class BlogpostsController < ApplicationController
end end
def new def new
@post = Blogpost.new if current_user && current_user.rank >= rank_to_int("mod")
@post = Blogpost.new
else
flash[:alert] = "You are not allowed to create a new post!"
redirect_to blogposts_path
end
end end
# GET /blogposts/1/edit
def edit def edit
@post = Blogpost.find(params[:id]) @post = Blogpost.find(params[:id])
if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @post.user.rank.to_i) || (current_user == @edit.user))
else
flash[:alert] = "You are not allowed to update this post!"
end
end end
# POST /blogposts
# POST /blogposts.json
def create def create
if current_user && current_user.rank >= rank_to_int("mod") if current_user && current_user.rank >= rank_to_int("mod")
@post = Blogpost.new(params[:blogpost]) @post = Blogpost.new(params[:blogpost])
@post.user_id = current_user.id unless current_user.nil? @post.user = current_user
if @post.save if @post.save
redirect_to @post, notice: 'Post has been created.' redirect_to @post, notice: 'Post has been created.'
else else
@@ -35,24 +41,29 @@ class BlogpostsController < ApplicationController
end end
end end
# PUT /blogposts/1
# PUT /blogposts/1.json
def update def update
@post = Blogpost.find(params[:id]) @post = Blogpost.find(params[:id])
if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @post.user.rank.to_i) || (current_user == @post.user))
if @post.update_attributes(params[:blogpost]) if @post.update_attributes(params[:blogpost])
redirect_to @post, notice: 'Post has been updated.' redirect_to @post, notice: 'Post has been updated.'
else else
render action: "edit" flash[:alert] = "There was a problem while updating the post"
render action: "edit"
end
end end
end end
# DELETE /blogposts/1
# DELETE /blogposts/1.json
def destroy def destroy
@post = Blogpost.find(params[:id]) @post = Blogpost.find(params[:id])
@post.destroy if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @post.user.rank.to_i) || (current_user == @post.user))
if @post.destroy
redirect_to blog_url flash[:notice] = "Post deleted!"
else
flash[:alert] = "There was a problem while deleting this Post"
end
else
flash[:alert] = "You are not allowed to delete this Post"
end end
redirect_to blogpots_path
end
end end

87
app/controllers/comments_controller.rb
View File

@@ -1,50 +1,23 @@
class CommentsController < ApplicationController class CommentsController < ApplicationController
# GET /comments
# GET /comments.json
def index
@comments = Comment.all
respond_to do |format|
format.html # index.html.erb
format.json { render json: @comments }
end
end
# GET /comments/1
# GET /comments/1.json
def show
@comment = Comment.find(params[:id])
respond_to do |format|
format.html # show.html.erb
format.json { render json: @comment }
end
end
# GET /comments/new
# GET /comments/new.json
def new
@comment = Comment.new
respond_to do |format|
format.html # new.html.erb
format.json { render json: @comment }
end
end
# GET /comments/1/edit
def edit def edit
@comment = Comment.find(params[:id]) @comment = Comment.find(params[:id])
if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @comment.user.rank.to_i) || (current_user == @comment.user))
@comment = Comment.find(params[:id])
session[:return_to] = blogpost_path(@comment.blogpost)
else
flash[:alert] = "You are not allowed to edit this comment"
redirect_to @comment.blogpost
end
end end
# POST /comments
# POST /comments.json
def create def create
@comment = Comment.new(params[:comment]) if current_user
@comment.user_id = current_user.id @comment = Comment.new(params[:comment])
@comment.blogpost = Blogpost.find(params[:blogpost_id]) @comment.user_id = current_user.id
@comment.blogpost = Blogpost.find(params[:blogpost_id])
if @comment.save if @comment.save
redirect_to @comment.blogpost, notice: 'Comment was successfully created.' redirect_to @comment.blogpost, notice: 'Comment created!'
else else
flash[:alert] = "There was a problem while saving your comment" flash[:alert] = "There was a problem while saving your comment"
redirect_to blogpost_path(params[:blogpost_id]) redirect_to blogpost_path(params[:blogpost_id])
@@ -52,30 +25,34 @@ class CommentsController < ApplicationController
end end
end end
# PUT /comments/1
# PUT /comments/1.json
def update def update
@comment = Comment.find(params[:id]) @comment = Comment.find(params[:id])
if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @comment.user.rank.to_i) || (current_user == @comment.user))
respond_to do |format| if @comment.update_attributes(params[:comment])
if @comment.update_attributes(params[:comment]) flash[:notice] = "Comment updated!"
format.html { redirect_to @comment, notice: 'Comment was successfully updated.' } redirect_to @comment.blogpost
format.json { head :no_content } else
flash[:alert] = "There was a problem while updating your comment"
redirect_to session[:return_to]
session.delete(:redirect_to)
end
else else
format.html { render action: "edit" } flash[:alert] = "You are not allowed to edit this comment"
format.json { render json: @comment.errors, status: :unprocessable_entity } redirect_to blogpost_path(params[:blogpost_id])
end end
end end
# DELETE /comments/1
# DELETE /comments/1.json
def destroy def destroy
@comment = Comment.find(params[:id]) @comment = Comment.find(params[:id])
@comment.destroy if current_user && ((current_user.rank >= rank_to_int("mod") && current_user.rank.to_i >= @comment.user.rank.to_i) || (current_user == @comment.user))
if @comment.destroy
respond_to do |format| flash[:notice] = "Comment deleted!"
format.html { redirect_to comments_url } else
format.json { head :no_content } flash[:alert] = "There was a problem while deleting this comment"
end
else
flash[:alert] = "You are not allowed to delete this comment"
end end
redirect_to @comment.blogpost
end end
end end

9
app/controllers/users_controller.rb
View File

@@ -1,12 +1,9 @@
class UsersController < ApplicationController class UsersController < ApplicationController
# GET /users
# GET /users.json
def index def index
@users = User.all @users = User.all
end end
# GET /users/1
# GET /users/1.json
def show def show
@user = User.find(params[:id]) @user = User.find(params[:id])
end end
@@ -27,7 +24,7 @@ class UsersController < ApplicationController
if current_user && (current_user.id = params[:id] || current_user.rank >= rank_to_int("mod")) if current_user && (current_user.id = params[:id] || current_user.rank >= rank_to_int("mod"))
@user = User.find(params[:id]) @user = User.find(params[:id])
else else
flash[:alert] = "You are not allwoed to edit this user" flash[:alert] = "You are not allowed to edit this user"
redirect_to user_path(params[:id]) redirect_to user_path(params[:id])
end end
end end
@@ -36,9 +33,11 @@ class UsersController < ApplicationController
# POST /users.json # POST /users.json
def create def create
@user = User.new(params[:user]) @user = User.new(params[:user])
@user.last_ip = request.remote_ip
if @user.save if @user.save
redirect_to @user, notice: 'User was successfully created.' redirect_to @user, notice: 'User was successfully created.'
else else
flash[:alert] = "Something went wrong"
render action: "new" render action: "new"
end end
end end

2
app/helpers/users_helper.rb
View File

@@ -2,7 +2,7 @@ module UsersHelper
def avatar_url(user_id, size) def avatar_url(user_id, size)
u = User.find_by_id(user_id) u = User.find_by_id(user_id)
u.nil? ? ign = :char : ign = u.ign u.nil? ? ign = :char : ign = u.ign
return "https://minotar.net/avatar/#{ign}/#{size}" return "https://minotar.net/helm/#{ign}/#{size}"
end end
def mc_running? def mc_running?

4
app/models/comment.rb
View File

@@ -1,6 +1,6 @@
class Comment < ActiveRecord::Base class Comment < ActiveRecord::Base
attr_accessible :text, :user_id, :blogpost, :post attr_accessible :text, :user, :blogpost, :post
validates_presence_of :text, :user_id, :blogpost_id validates_presence_of :text, :user, :blogpost
belongs_to :blogpost belongs_to :blogpost
belongs_to :user belongs_to :user
end end

2
app/views/blogposts/show.html.erb
View File

@@ -12,7 +12,7 @@
<div class="comment <%= "author" if c.user == @post.user %>"> <div class="comment <%= "author" if c.user == @post.user %>">
<span class="comment-info"><%= link_to c.user.name, c.user %> on <%= c.created_at.strftime("%e. %b %Y") %> <span class="comment-info"><%= link_to c.user.name, c.user %> on <%= c.created_at.strftime("%e. %b %Y") %>
<% if current_user && current_user.rank >= rank_to_int("mod") %> <% if current_user && current_user.rank >= rank_to_int("mod") %>
- <%= link_to "edit", edit_blogpost_comment_path(c.id) %> - <%= link_to "edit", edit_blogpost_comment_path(c.blogpost, c) %>
<% end %> <% end %>
</span> </span>
<div class="comment-content"><%= c.text %></div> <div class="comment-content"><%= c.text %></div>

17
app/views/comments/_form.html.erb
View File

@@ -1,17 +0,0 @@
<%= form_for(@comment) do |f| %>
<% if @comment.errors.any? %>
<div id="error_explanation">
<h2><%= pluralize(@comment.errors.count, "error") %> prohibited this comment from being saved:</h2>
<ul>
<% @comment.errors.full_messages.each do |msg| %>
<li><%= msg %></li>
<% end %>
</ul>
</div>
<% end %>
<div class="actions">
<%= f.submit %>
</div>
<% end %>

10
app/views/comments/edit.html.erb
View File

@@ -1,6 +1,6 @@
<h1>Editing comment</h1> <h1>Edit comment</h1>
<%= render 'form' %> <%= simple_form_for [@comment.blogpost, @comment] do |f| %>
<%= f.input :text, :label => false, :as => "text", :placeholder => "Comment" %>
<%= link_to 'Show', @comment %> | <%= f.submit %>
<%= link_to 'Back', comments_path %> <% end %>

21
app/views/comments/index.html.erb
View File

@@ -1,21 +0,0 @@
<h1>Listing comments</h1>
<table>
<tr>
<th></th>
<th></th>
<th></th>
</tr>
<% @comments.each do |comment| %>
<tr>
<td><%= link_to 'Show', comment %></td>
<td><%= link_to 'Edit', edit_comment_path(comment) %></td>
<td><%= link_to 'Destroy', comment, method: :delete, data: { confirm: 'Are you sure?' } %></td>
</tr>
<% end %>
</table>
<br />
<%= link_to 'New Comment', new_comment_path %>

5
app/views/comments/new.html.erb
View File

@@ -1,5 +0,0 @@
<h1>New comment</h1>
<%= render 'form' %>
<%= link_to 'Back', comments_path %>

5
app/views/comments/show.html.erb
View File

@@ -1,5 +0,0 @@
<p id="notice"><%= notice %></p>
<%= link_to 'Edit', edit_comment_path(@comment) %> |
<%= link_to 'Back', comments_path %>

18
app/views/users/index.html.erb
View File

@@ -1,4 +1,14 @@
<h1>Listing users</h1> <h1>All users</h1>
<% @users.each do |u| %> <div id="userlist">
<%= link_to u.name, u %> (<%= u.ign %>) <% @users.each do |u| %>
<% end %> <div class="list-user">
<%= link_to u do %>
<%= image_tag(avatar_url(u.id, 64), :class => "avatar", :alt => "avatar") %>
<div class="user-info">
<span class="user-name"><%= u.name %></span>
<span class="user-ign"><%= u.ign %></span>
</div>
<% end %>
</div>
<% end %>
</div>