HTML escape description to prevent code injection onto page

[selectricity] / app / controllers / election_controller.rb

diff --git a/app/controllers/election_controller.rb b/app/controllers/election_controller.rb
index f4b89b40cb9c291e41443c1bdf73f502589d4e1e..df0aa7c53631ab968b7d2f6bf963172645ae4f3f 100644 (file)
--- a/app/controllers/election_controller.rb
+++ b/app/controllers/election_controller.rb
@@ -1,8 +1,8 @@
 class ElectionController < ApplicationController
   model :raw_voter_list, :voter, :vote, :candidate
-  layout 'vb'
+  layout 'main'
 
-  before_filter :login_required
+  #before_filter :login_required
 
   ## methods for displaying, creating,
   ## and manipulating election overview data
@@ -22,7 +22,7 @@ class ElectionController < ApplicationController
 
     if @election.save
       flash[:notice] = 'Election was successfully created.'
-      redirect_to :action => 'new_candidates', :id => @election.id
+      redirect_to :action => 'edit_candidates', :id => @election.id
     else
       render :action => 'new'
     end
@@ -48,27 +48,36 @@ class ElectionController < ApplicationController
     end
   end
 
-  def destroy
-    election = Election.find(params[:id]).destroy
-    redirect_to :action => 'list'
+  def start_election
+    @election = Election.find(params[:id])
+    
+    @election.voters.each do |voter|
+      email = VoterNotify.deliver_votestart(voter)
+      #render(:text => "<pre>" + email.encoded + "</pre>")
+    end
+
+    @election.activate!
+    redirect_to :action => 'show', :id => @election.id
   end
 
   # methods fod display, adding, deleting, and manipulating candidate
   # information for elections
   ####################################################################
-  def new_candidates
+  def edit_candidates
     @election = Election.find( params[:id] )
   end
 
   def add_candidate
-    election = Election.find( params[:id] )
-    @candidate = Candidate.new
-    @candidate.name = params[:newcandidate][:name]
-    @candidate.description = params[:newcandidate][:description]
+    @election = Election.find(params[:id])
+    @candidate = Candidate.new(params[:candidate])
     
-    @candidate.save
-    election.candidates << @candidate
-    render :partial => 'candidate_line'
+    if @candidate.save
+      @election.candidates << @candidate
+      @candidate = Candidate.new
+      redirect_to :action => 'edit_candidates', :id => @election.id
+    else
+      render :action => 'edit_candidates', :id => @election.id
+    end
   end
   
   def delete_candidate
@@ -76,8 +85,40 @@ class ElectionController < ApplicationController
     candidate.destroy
   end
 
-  def edit_candidates
-    @election = Election.find( params[:id] )
+  def lessinfo_candidate
+    @show_details = false
+    @candidate = Candidate.find( params[:id] )
+    render :partial => 'candidate_line'
+  end
+
+  def moreinfo_candidate
+    @show_details = true
+    @candidate = Candidate.find( params[:id] )
+    render :partial => 'candidate_line'
+  end
+
+  def edit_candidate
+    @candidate = Candidate.find( params[:id] )
+    @election = @candidate.election
+  end
+
+  def update_candidate
+    @candidate = Candidate.find(params[:id])
+    @election = @candidate.election
+
+    if @candidate.update_attributes(params[:candidate])
+      redirect_to :action => 'edit_candidates', :id => @candidate.election.id
+    else
+      render :action => 'edit_candidate'
+    end
+  end
+
+  def candidate_picture
+    candidate = Candidate.find( params[:id] )
+    send_data( candidate.picture_data,
+               :filename => candidate.picture_filename,
+              :type => candidate.picture_type,
+              :disposition => 'inline' )
   end
 
   ## methods for displaying, adding, deleting, and manipulating voters
@@ -155,15 +196,15 @@ class ElectionController < ApplicationController
 
           if incoming_voters.email == 0
             new_voter.contacted = 1
-         elsif incoming_voters.email == 1
-           email_voter( new_voter )
-           new_voter.contacted = 1
-         else
-           new_voter.contacted = 0
-         end
+               elsif incoming_voters.email == 1
+                 email_voter( new_voter )
+            new_voter.contacted = 1
+               else
+                 new_voter.contacted = 0
+          end
        
           # the new voter should be in good shape. save add to the election
-         new_voter.save
+               new_voter.save
           @election.voters << new_voter
         end
       end
@@ -173,7 +214,10 @@ class ElectionController < ApplicationController
       @raw_voter_list.email = incoming_voters.email
     end
 
-    def email_voter
+    def email_voter(email=nil)
+      if email
+        
+      end
     end
 
 end