bterkuile/mozo-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

major updates to security and hacking logick

Browse Source
This commit is contained in:
Benjamin ter Kuile
2013-01-13 12:21:30 +01:00
parent b02951aaec
commit f08d19a50b
19 changed files with 379 additions and 296 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/user_controller.rb
+41 -28
View File
@@ -1,6 +1,6 @@
class UserController < ApplicationController
before_filter :allow_mobile
before_filter :user_authentication, except: [:obtain_token, :index]
before_filter :user_authentication, :unless => ->(c){ %w(obtain_token index).include?(c.action_name) || c.request.format.symbol == :html } # , except: [:obtain_token, :index]
layout 'phone'
def user_authentication
@@ -50,34 +50,37 @@ class UserController < ApplicationController
# POST /user/create_list {table_id: 1234}
#DEPRICATED
def create_list
render nothing: true and return unless current_user.present?
@table = Table.find(params[:table_id])
if @table.occupied?
respond_to do |format|
format.html { redirect_to root_path, alert: t('table.is_occupied') }
format.json { render json: js_alert(t('messages.table_is_occupied'))}
format.html { redirect_to user_root_path, alert: t('messages.table_is_occupied') }
format.json { render json: json_alert('messages.table_is_occupied')}
end
else
if @list = List.from_table( @table, current_user )
end
respond_to do |format|
format.html { redirect_to user_list_products_path }
format.json { render json: js_notice('table_created')}
format.json { render json: json_notice('messages.new_list_created')}
end
end
end
# GET /user/table_info.json
def table_info
@table = Table.find(params[:table_id])
res = {}
res[:occupied] = @table.occupied?
res[:reserved] = @table.reserved?
res[:supplier_closed] = @table.supplier.closed?
if list.present?
res[:other_supplier] = true if list.supplier_id != @table.supplier_id
res[:current_table_id] = list.table_id
end
respond_to do |format|
format.json do
render json: json_alert('messages.table_not_found') and return unless params[:table_id].present?
@table = Table.find(params[:table_id])
res = {}
res[:occupied] = @table.occupied?
res[:reserved] = @table.reserved?
res[:supplier_closed] = @table.supplier.closed?
if list.present?
res[:other_supplier] = true if list.supplier_id != @table.supplier_id
res[:current_table_id] = list.table_id
end
render json: res
end
end
@@ -113,6 +116,7 @@ class UserController < ApplicationController
format.html do
end
format.json do
render json: json_alert('messages.table_not_found') and return unless params[:table_id].present?
@table = Table.find(params[:table_id])
h = ProductCategory.for_user(current_user, table: @table)
render json: h
@@ -128,6 +132,7 @@ class UserController < ApplicationController
# POST /user/join_occupied_table
def request_to_join_occupied_table
render json: json_alert('messages.table_not_found') and return unless params[:table_id].present?
@table = Table.find(params[:table_id])
if @list = @table.active_list
@list.send_table_join_request_for_user! current_user
@@ -135,20 +140,24 @@ class UserController < ApplicationController
render nothing: true
end
# POST /user/reject_join_request?user_id=1
def reject_join_request
return unless params[:user_id]
render js: '' and return unless params[:user_id].present?
list && list.reject_join_request_for_user!(params[:user_id])
render js: ''
end
# POST /user/approve_join_request?user_id=1
def approve_join_request
return unless params[:user_id]
render js: '' and return unless params[:user_id].present?
@user = User.find(params[:user_id])
list && list.approve_join_request_for_user!(@user)
render nothing: true
end
# POST /user/check_table_join_status table_id:12345
# POST /user/check_table_join_status.json table_id:12345
def check_table_join_status
render json: json_alert('messages.table_not_found') and return unless params[:table_id].present?
@table = Table.find(params[:table_id])
if @list = @table.active_list
if @list.user_ids.include?(current_user.id)
@@ -169,7 +178,7 @@ class UserController < ApplicationController
def active_list
respond_to do |format|
format.html do
redirect_to(root_path, alert: t('messages.there_is_no_list_active')) and return unless list.present?
redirect_to(user_root_path, alert: t('messages.there_is_no_list_active')) and return unless list.present?
end
format.json do
render json: js_alert(t('messages.the_list_has_been_closed')) and return unless list.present?
@@ -205,7 +214,7 @@ class UserController < ApplicationController
def needs_help
respond_to do |format|
format.json do
render json: {list_active: false} and return unless list.present?
render json: json_alert('messages.no_active_list', list_active: false) and return unless list.present?
list.needs_help!
render json: list.as_json.merge(list_active: list.active?)
end
@@ -216,7 +225,7 @@ class UserController < ApplicationController
def list_needs_payment
respond_to do |format|
format.json do
render json: {list_active: false} and return unless list.present?
render json: json_alert('messages.no_active_list', list_active: false) and return unless list.present?
list.needs_payment!
render json: list.as_json.merge(list_active: list.active?)
end
@@ -246,11 +255,11 @@ class UserController < ApplicationController
end
format.json do
@list = List.find(params[:list_id])
render json: json_alert('messages.illegal_history_list_attempt') and return unless @list.user_ids.include?(current_user.id)
if params[:list_closed].present? && current_user.active_list_id == @list.id
current_user.list_is_closed!
flash.now[:notice] = t('messages.the_list_has_been_closed', list: List.model_name.human)
end
redirect_to user_root_path, alert: t('messages.illegal_history_list_attempt') and return unless @list.user_ids.include?(current_user.id)
render json: @list.with_orders_as_json.merge(supplier_name: @list.supplier.name)
end
end
@@ -262,10 +271,10 @@ class UserController < ApplicationController
if list.present?
@list = list
else
render json: js_alert('table_not_found') and return unless params[:table_id].present?
render json: json_alert('messages.table_not_found') and return unless params[:table_id].present?
@table = Table.find(params[:table_id])
if @table.occupied?
render json: js_alert('table_is_occupied')
render json: json_alert('messages.table_is_occupied', location: :join_occupied_table, location_params: {table_id: @table.id})
else
if @list = List.from_table( @table, current_user )
else
@@ -275,19 +284,20 @@ class UserController < ApplicationController
end
respond_to do |format|
format.html do
redirect_to(root_path, alert: t('messages.cannot_order_on_non_active_list')) and return unless @list.active?
redirect_to(user_root_path, alert: t('messages.cannot_order_on_non_active_list')) and return unless @list.active?
@list.place_order current_user, params[:products]
redirect_to root_path, notice: t('messages.order_is_placed')
redirect_to user_root_path, notice: t('messages.order_is_placed')
end
format.js do
render js: js_alert(t('messages.cannot_order_on_non_active_list')) and return unless @list.active?
format.json do
render json: json_alert('messages.cannot_order_on_non_active_list') and return unless @list.active?
@list.place_order current_user, params[:products]
render js: js_notice( t('messages.order_is_placed'), location: :active_list)
render json: json_notice('messages.order_is_placed', location: :active_list)
end
end
end
def move_table
return unless list.present?
render json: json_alert('messages.no_active_list', list_active: false) and return unless list.present?
@table = Table.find(params[:table_id])
if @table.occupied?
render json: {occupied: true}
@@ -298,11 +308,14 @@ class UserController < ApplicationController
end
private
def handle_message_params
flash.now[:notice] = t('messages.the_list_has_been_closed', list: List.model_name.human) if params[:list_closed].present?
flash.now[:notice] = t("messages.#{params[:message]}", list: List.model_name.human, supplier: Supplier.model_name.human) if params[:message].present? && params[:message] =~ /^\w+$/
end
# General handler of json responses. Will be able to set some additional communication data.
# By default a response is ok.
def json_response(obj = {})
obj[:ok] = true unless obj.has_key?(:ok)
obj