HTML escape description to prevent code injection onto page

[selectricity] / app / controllers / quickvote_controller.rb

diff --git a/app/controllers/quickvote_controller.rb b/app/controllers/quickvote_controller.rb
index 97f4ab05fb726bd0a03cdce10ee88c025cbbfd98..4783eb2d72ee79af31bd74f1e3de9112b02b7114 100644 (file)
--- a/app/controllers/quickvote_controller.rb
+++ b/app/controllers/quickvote_controller.rb
@@ -1,31 +1,21 @@
 class QuickvoteController < ApplicationController
 class QuickvoteController < ApplicationController

-  layout 'hc'
+  layout 'main'

   model :quick_voter
   model :quick_voter

+  model :quick_vote

   model :vote
   model :election
 
   model :vote
   model :election
 

-  def index
-    @election = QuickVote.find_all(["name = ?", params[:votename]])[0]
-
-    if @election
-      @voter = QuickVoter.find_all(["session_id = ? and election_id = ?",
-                                  session.session_id, @election.id])[0]
-      unless @voter 
-        @voter = QuickVoter.new
-        @voter.election = QuickVote.find_all( [ "name = ?", params[:votename] ] )[0]
-      end
-    else
-      redirect_to :controller => 'site'
-    end
-  end
+  #############################################################
+  # the following methods pertain to creating quickvotes
+  #############################################################

 
   def create
     if params[:quickvote] 
       @quickvote = QuickVote.new(params[:quickvote])
 
   def create
     if params[:quickvote] 
       @quickvote = QuickVote.new(params[:quickvote])

-
+     

       # store the candidate grabbed through ajax and stored in flash
       @quickvote.candidatelist = flash[:candlist]
       # store the candidate grabbed through ajax and stored in flash
       @quickvote.candidatelist = flash[:candlist]

-
+      @quickvote.description=CGI.escapeHTML(@quickvote.description)

       # try to save, if it fails, show the page again (the flash should
       # still be intact
       if @quickvote.save
       # try to save, if it fails, show the page again (the flash should
       # still be intact
       if @quickvote.save


@@ -34,6 +24,7 @@ class QuickvoteController < ApplicationController
       else
         flash.keep(:candlist)
       end 
       else
         flash.keep(:candlist)
       end 

+

     else
       # if we don't have a quickvote param, it means that the person
       # here has not been hitting this page and we can clear any
     else
       # if we don't have a quickvote param, it means that the person
       # here has not been hitting this page and we can clear any


@@ -43,65 +34,119 @@ class QuickvoteController < ApplicationController
   end
 
   def add_candidate
   end
 
   def add_candidate

-    candidate_name = params[:ajax][:newcandidate]
-    if flash.has_key?(:candlist) and flash[:candlist].instance_of?(Array) 
-      flash[:candlist] << candidate_name
-    else
-      flash[:candlist] = [ candidate_name ]
+    candidate_name = CGI.escapeHTML(params[:ajax][:newcandidate])
+    unless candidate_name.strip.empty?
+      if flash.has_key?(:candlist) and flash[:candlist].instance_of?(Array) 
+        flash[:candlist] << candidate_name unless flash[:candlist].index(candidate_name)
+     else
+       flash[:candlist] = [ candidate_name ]
+      end

     end
     flash.keep(:candlist)
     render_partial 'candidate_list'
   end
     end
     flash.keep(:candlist)
     render_partial 'candidate_list'
   end

+ 
+  #############################################################
+  # the following methods pertain to *voting* in the quickvotes
+  #############################################################

 
 

-  def change
-    voter = QuickVoter.find_all(["session_id = ?", session.session_id])[0]
-    voter.destroy
-    redirect_to quickvote_url( :votename => params[:votename] )
+  def index
+    @election = QuickVote.ident_to_quickvote(params[:ident])
+    
+    # if the person has specified an election, we show them the voting
+    # page. otherwise, we redirect back to main the page
+    if @election
+
+      # look to see that the voter has been created and has voted in
+      # this election, and has confirmed their vote
+      @voter = QuickVoter.find_all(["session_id = ? and election_id = ?",
+                                  session.session_id, @election.id])[0]
+
+      # if the voter has not voted we destroy them
+      if @voter and not @voter.voted?
+        @voter.destroy
+       @voter = nil
+      end
+
+      # if the voter does not exist or has has been destroyed, lets
+      # create a new one
+      unless @voter
+        # create a new voter and populate it
+        @voter = QuickVoter.new
+        @voter.election = @election
+        @voter.session_id = session.session_id
+        
+             # create new vote and make it the defaulted sorted list
+        @voter.vote = Vote.new
+             @voter.save
+             @voter.vote.set_defaults!
+             @voter.reload
+      end
+    else
+      redirect_to :controller => 'site'
+    end

   end
 
   def confirm
   end
 
   def confirm

-    election = QuickVote.find_all(["name = ?", params[:votename]])[0]
+    # we need the election to verify that we have the right voter
+    election = QuickVote.ident_to_quickvote(params[:ident])

 
 

-    if QuickVoter.find_all(["session_id = ? and election_id = ?", 
-                            session.session_id, election.id])[0]
+    # find out who the voter is for this election
+    @voter = QuickVoter.find_all(["session_id = ? and election_id = ?", 
+                                 session.session_id, election.id])[0]
+  
+    if not @voter
+      # we have not seen this  voter before. something is wrong, try
+      # again
+      redirect_to quickvote_url( :ident => params[:ident] ) 
+      
+    elsif @voter.voted? 
+      # this person has already voted, we try again

       flash[:notice] = "You have already voted!"
       flash[:notice] = "You have already voted!"

-      redirect_to quickvote_url( :votename => params[:votename] )
+      redirect_to quickvote_url( :ident => params[:ident] )
+      

     else
     else

-      @voter = QuickVoter.new()
-      @voter.election = election
-      @voter.session_id = session.session_id
+      # record the ip address for posterity

       @voter.ipaddress = request.env["REMOTE_ADDR"]
       @voter.save
       @voter.ipaddress = request.env["REMOTE_ADDR"]
       @voter.save

-      @voter.reload
-        
-      @voter.vote = Vote.new
-      @voter.vote.votestring = params[:vote][:votestring]
+      
+      # save the time the vote was made for statistical use
+      @voter.vote.time = Time.now
+      
+      # toggle the confirmation bit      

       @voter.vote.confirm!
       @voter.vote.confirm!

+     
+      @voter.reload

       render :action => 'thanks'
     end
   end
       render :action => 'thanks'
     end
   end

-  
-  def results
-    @election = QuickVote.find_all( ["name = ?", params[:votename]] )[0]
+ 
+  def change
+    voter = QuickVoter.find_all(["session_id = ?", session.session_id])[0]
+    voter.destroy
+    redirect_to quickvote_url( :ident => params[:ident] )
+  end

 
 

-    preference_tally = []
-    plurality_tally = []
-    approval_tally = []
-    @election.voters.each do |voter|
-      plurality_tally << voter.vote.rankings.sort[0].candidate.id
-      approval_tally << voter.vote.rankings.sort[0..1].collect {|ranking| ranking.candidate.id}
-      preference_tally << voter.vote.rankings.sort.collect {|ranking| ranking.candidate.id}
+  def sort_candidates
+    @vote = Vote.find(params[:id])
+
+    @vote.rankings.each do |ranking|
+      ranking.rank = params['rankings-list'].index(ranking.candidate.id.to_s) + 1
+      ranking.save

     end
     end

- 
-    @plurality_result = PluralityVote.new(plurality_tally).result
-    @approval_result = ApprovalVote.new(approval_tally).result
-    @condorcet_result = CloneproofSSDVote.new(preference_tally).result
-    @ssd_result = PureCondorcetVote.new(preference_tally).result
-    @borda_result = BordaVote.new(preference_tally).result
-    @runoff_result = InstantRunoffVote.new(preference_tally).result
+    render :nothing => true
+  end
+               

 
 

-    @candidates = {} 
+  ###############################################################
+  # the following method pertains to displaying the results of a
+  # quickvote
+  ###############################################################
+
+  def results
+    @election = QuickVote.ident_to_quickvote(params[:ident])
+    @election.results
+    @candidates = {}

     @election.candidates.each {|c| @candidates[c.id] = c}
   end
     @election.candidates.each {|c| @candidates[c.id] = c}
   end

-

 end
 end