Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / models / selectricity_service.rb

diff --git a/app/models/selectricity_service.rb b/app/models/selectricity_service.rb
index 3f0a3bf7442ba12deb8d9d96ae5944af272085dc..196161a467ea2bcfb25f5be2f5cb3d22c6123e21 100644 (file)
--- a/app/models/selectricity_service.rb
+++ b/app/models/selectricity_service.rb
@@ -5,6 +5,12 @@ class SelectricityService < ActionWebService::Base
   def cast_quickvote(election_name, voter_id, vote_list)
     election = QuickVote.ident_to_quickvote election_name
     if election
   def cast_quickvote(election_name, voter_id, vote_list)
     election = QuickVote.ident_to_quickvote election_name
     if election

+      candidates=election.candidates.collect { |c| c.id }
+      vote_list[0].each do |vote|
+        raise ArgumentError.new("Invalid Candidate ID #{vote}") unless candidates.index(vote)
+      end
+      raise ArgumentError.new("You must rank all candidates") unless candidates.length <= vote_list[0].length
+      raise ArgumentError.new("Please rank each candidate only once") if vote_list[0].uniq!

       voter = QuickVoter.new
       voter.election = election
       voter.ipaddress = "XMLRPC Request"
       voter = QuickVoter.new
       voter.election = election
       voter.ipaddress = "XMLRPC Request"


@@ -15,12 +21,14 @@ class SelectricityService < ActionWebService::Base
       voter.save!
       voter.vote.confirm!
       voter.save!
       voter.save!
       voter.vote.confirm!
       voter.save!

+    else
+      raise ArgumentError.new("Cannot find election #{election_name}")

     end
   end
   def quickvote_candidate_ids_to_names(shortname, id_list)
     qv=QuickVote.ident_to_quickvote(shortname)
     candidates={}
     end
   end
   def quickvote_candidate_ids_to_names(shortname, id_list)
     qv=QuickVote.ident_to_quickvote(shortname)
     candidates={}

-    return [] unless qv
+    raise ArgumentError.new("Quickvote by name #{shortname} doesn't exist") unless qv

     qv.results
     qv.candidates.each {|c| candidates[c.id] = c}
     results=[]
     qv.results
     qv.candidates.each {|c| candidates[c.id] = c}
     results=[]


@@ -38,10 +46,8 @@ class SelectricityService < ActionWebService::Base
     #TODO: Validate shortname
     qv=QuickVote.ident_to_quickvote(shortname)
     result=VoteResultStruct.new
     #TODO: Validate shortname
     qv=QuickVote.ident_to_quickvote(shortname)
     result=VoteResultStruct.new

-    result.errors=[]

     unless qv
     unless qv

-      result.errors << "No quickvote with name #{shortname} found!"
-      return result
+      raise ArgumentError.new("No quickvote with name #{shortname} found!")

     end
     qv.results
     result.plurality_winners=qv.plurality_result.winners
     end
     qv.results
     result.plurality_winners=qv.plurality_result.winners


@@ -54,10 +60,8 @@ class SelectricityService < ActionWebService::Base
   def get_quickvote_candidate_map(shortname)
     qv=QuickVote.ident_to_quickvote(shortname)
     result=CandidateMap.new
   def get_quickvote_candidate_map(shortname)
     qv=QuickVote.ident_to_quickvote(shortname)
     result=CandidateMap.new

-    result.errors=[]

     unless qv
     unless qv

-      result.errors << "No quickvote with name #{shortname} found!"
-      return result
+      raise ArgumentError.new("No quickvote with name #{shortname} found!")

     end
     candidates={}
     qv.candidates.each {|c| candidates[c.id] = c.name}
     end
     candidates={}
     qv.candidates.each {|c| candidates[c.id] = c.name}


@@ -69,28 +73,32 @@ class SelectricityService < ActionWebService::Base
     qv=QuickVote.ident_to_quickvote(shortname)
     votes=Array.new
     unless qv
     qv=QuickVote.ident_to_quickvote(shortname)
     votes=Array.new
     unless qv

-      return result
+      raise ArgumentError.new("Cannot find QuickVote #{shortname}")

     end
     qv.votes.each  do |vote|
     end
     qv.votes.each  do |vote|

-      votes << VoteInfo.new(:voter_id => vote.voter.id, :voter_ipaddress => vote.voter.ipaddress, :vote_time => vote.time.to_i)
+      votes << VoteInfo.new(:voter_id => vote.voter.id, :voter_ipaddress => vote.voter.ipaddress, :vote_time => vote.time.to_i, :vote => vote.votes, :voter_session_id => vote.voter.session_id )

     end
     return votes
   end
   def list_quickvotes()
     all=Array.new
     end
     return votes
   end
   def list_quickvotes()
     all=Array.new

-    QuickVote.find_all.each do |election|
+    QuickVote.find(:all).each do |election|

       all << get_quickvote(election.name)
     end
     return all
   end
   def get_quickvote(shortname)
       all << get_quickvote(election.name)
     end
     return all
   end
   def get_quickvote(shortname)

-    return ElectionStruct.new unless election=QuickVote.ident_to_quickvote(shortname)
-    return ElectionStruct.new (:id => election.id, :name => election.name, :description => election.description, :candidate_ids => election.candidates.collect {|c| c.id }, :candidate_names => election.candidates.collect {|c| c.name } )
+    raise ArgumentError.new("Cannot find QuickVote named #{shortname}") unless election=QuickVote.ident_to_quickvote(shortname)
+    return ElectionStruct.new(:id => election.id, :name => election.name, :description => election.description, :candidate_ids => election.candidates.collect {|c| c.id }, :candidate_names => election.candidates.collect {|c| c.name } )

   end
   def create_quickvote(election)
     qv=QuickVote.new(:name => election.name, :description => election.description)
     qv.candidatelist=election.candidate_names
   end
   def create_quickvote(election)
     qv=QuickVote.new(:name => election.name, :description => election.description)
     qv.candidatelist=election.candidate_names

-    return qv.save.to_s
+    if qv.save
+      return ""
+    else
+      raise ArgumentError.new("Saving quickvote FAILED:"+qv.errors.inspect)
+    end

   end
 
 end
   end
 
 end