HTML escape description to prevent code injection onto page

[selectricity-live] / app / models / quick_vote.rb

diff --git a/app/models/quick_vote.rb b/app/models/quick_vote.rb
index 3538a3cc5d9047f2a4a7fccc8cc925bca6c2e2f2..13e616824c58c0a1f3b3610bf7e0322fd49604c6 100644 (file)
--- a/app/models/quick_vote.rb
+++ b/app/models/quick_vote.rb
@@ -3,23 +3,35 @@ class QuickVote < Election
   validates_uniqueness_of :name
   attr_accessor :raw_candidates
   attr_accessor :reviewed
+  attr_accessor :plurality_result
+  attr_accessor :approval_result
+  attr_accessor :condorcet_result
+  attr_accessor :ssd_result
+  attr_accessor :borda_result
 
   def validate
-    if @raw_candidates.length < 2
-      errors.add("You must list at least two candidates.")
+    if not @raw_candidates or @raw_candidates.length < 2
+        errors.add(nil, "You must list at least two candidates.")
     end
-
+    
     if name =~ /[^A-Za-z0-9]/
-      errors.add("The name must only include numbers and letters.")
+      errors.add(:name, "must only include numbers and letters.")
+    end
+    if name =~ /^[0-9]+$/
+      errors.add(:name, "must not be a number")
+    end
+    
+    if name =~ /^(create|index|confirm|change|results)$/
+      errors.add(:name, " is a reserved word.")
     end
   end
   
   def initialize(params={})
     super
-    self.enddate =  Time.now + 30
+    self.startdate = Time.now
+    self.enddate =  Time.now + 30.days
     self.active = 1
     self.anonymous = 1
-    self.quickvote = 1
   end
 
   def candidatelist=(candlist)
@@ -35,10 +47,49 @@ class QuickVote < Election
   end
 
   def create_candidates
+    return unless errors.empty?
     @raw_candidates.each do |name|
       candidate = Candidate.new({:name => name})
-      candidate.save
       self.candidates << candidate
     end
   end
+
+  #Calculate Election Results
+  def results
+    # initalize the tallies to empty arrays
+    preference_tally = Array.new
+    plurality_tally = Array.new
+    approval_tally = Array.new
+
+    self.voters.each do |voter|
+      # skip if the voter has not voted or has an unconfirmed vote
+      next unless voter.voted?
+
+      plurality_tally << voter.vote.rankings.sort[0].candidate.id
+      approval_tally << voter.vote.rankings.sort[0..1].collect \
+        { |ranking| ranking.candidate.id }
+      preference_tally << voter.vote.rankings.sort.collect \
+        { |ranking| ranking.candidate.id }
+    end
+    @plurality_result = PluralityVote.new(plurality_tally).result
+    @approval_result = ApprovalVote.new(approval_tally).result
+    @condorcet_result = PureCondorcetVote.new(preference_tally).result
+    @ssd_result = CloneproofSSDVote.new(preference_tally).result
+    @borda_result = BordaVote.new(preference_tally).result
+    #@runoff_result = InstantRunoffVote.new(preference_tally).result
+    #@runoff_results = PluralityVote.new(preference_tally).result
+
+  end
+
+  ### Convert a shortname or id into a QuickVote
+  def self.ident_to_quickvote(ident)
+    return nil unless ident
+    if ident.match(/^\d+$/)
+      quickvote = QuickVote.find(ident)
+    else
+      quickvote = QuickVote.find_all(["name = ?", ident])[0]
+    end
+
+    return quickvote
+  end
 end