Add a bunch of fixes to HTML escaping, and a test case for it

[selectricity-live] / app / models / quick_vote.rb

diff --git a/app/models/quick_vote.rb b/app/models/quick_vote.rb
old mode 100755 (executable)
new mode 100644 (file)
index ab97e61..c0367d6
--- a/app/models/quick_vote.rb
+++ b/app/models/quick_vote.rb
@@ -1,25 +1,47 @@
 class QuickVote < Election
   after_validation :create_candidates
   validates_uniqueness_of :name
+  validates_presence_of :name
   attr_accessor :raw_candidates
   attr_accessor :reviewed
-
+  
   def validate
-    if @raw_candidates.length < 2
-      errors.add("You must list at least two candidates.")
+    if not @raw_candidates or @raw_candidates.length < 2
+      errors.add(nil, "You must list at least two candidates.")
     end
+    
+    @raw_candidates.each do |c|
+      unless c.instance_of? String
+        errors.add(nil, "Candidates must be strings")
+        next
+      end
+      c.strip!
+      if c.length == 0
+        errors.add(nil, "Candidate name must not be empty")
+        next
+      end
+    end if @raw_candidates
+
+    errors.add(nil, "Candidates must all be unique") if @raw_candidates and @raw_candidates.uniq!
 
     if name =~ /[^A-Za-z0-9]/
-      errors.add("The name must only include numbers and letters.")
+      errors.add(:name, "must only include numbers and letters.")
+    end
+    if name =~ /^[0-9]+$/
+      errors.add(:name, "must not be a number")
+    end
+    
+    if name =~ /^(create|index|confirm|change|results)$/
+      errors.add(:name, " is a reserved word.")
     end
   end
   
   def initialize(params={})
     super
+    self.startdate = Time.now
     self.enddate =  Time.now + 30.days
     self.active = 1
     self.anonymous = 1
-    self.quickvote = 1
   end
 
   def candidatelist=(candlist)
@@ -27,7 +49,7 @@ class QuickVote < Election
   end
 
   def name
-    read_attribute( :name ).downcase()
+    read_attribute( :name ).downcase() if read_attribute( :name )
   end
 
   def reviewed?
@@ -35,10 +57,22 @@ class QuickVote < Election
   end
 
   def create_candidates
+    return unless errors.empty?
     @raw_candidates.each do |name|
       candidate = Candidate.new({:name => name})
-      candidate.save
       self.candidates << candidate
     end
   end
+
+  ### Convert a shortname or id into a QuickVote
+  def self.ident_to_quickvote(ident)
+    return nil unless ident
+    if ident.match(/^\d+$/)
+      quickvote = QuickVote.find(ident)
+    else
+      quickvote = QuickVote.find(:all, :conditions => ["name = ?", ident])[0]
+    end
+
+    return quickvote
+  end
 end