fix security issue

[selectricity] / app / controllers / voter_controller.rb

diff --git a/app/controllers/voter_controller.rb b/app/controllers/voter_controller.rb
index e94f4a76f0faed8e1994d30356c41fef851b0387..a550f676cc3d2ced5c851eef5c4f4c8632363159 100644 (file)
--- a/app/controllers/voter_controller.rb
+++ b/app/controllers/voter_controller.rb
@@ -1,47 +1,225 @@
+# Selectricity: Voting Machinery for the Masses
+# Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
+# Copyright (C) 2007 Massachusetts Institute of Technology
+#
+# This program is free software. Please see the COPYING file for
+# details.
+

 class VoterController < ApplicationController
 class VoterController < ApplicationController

+  helper :sparklines

   layout 'main'
   layout 'main'

-  model :voter
-  model :vote
-  model :election
+  require_dependency "voter"
+  require_dependency "vote"
+  require_dependency "election"
+
+  before_filter :authenticate, :except => [:index, :login, :reminder,
+                                           :kiosk_ready, :sort_candidates]

 
   def index
 
   def index

-    password = params[:id]
-    password = params[:vote][:password] if params[:vote]
-    if @voter = FullVoter.find(:all, :conditions => [ "password = ?", password ] )[0]
-      render :action => 'fullvote'
+    if params[:election_id]
+      @election = Election.find(params[:election_id])
+      unless @election.authenticated?
+        @voter = OpenVoter.find(:all,
+          :conditions => ["session_id = ? and election_id = ?",
+          session.session_id, @election.id])[0]
+     
+        @voter = OpenVoter.new unless @voter
+
+        @voter.election = @election
+        @voter.session_id = session.session_id
+        @password = "open." + @election.id.to_s
+      end
+    elsif params[:urlpassword]
+      password = params[:urlpassword]
+
+      if @voter = FullVoter.find(:all,
+        :conditions => [ "password = ?", password ] )[0]
+        @election = @voter.election
+        @password = @voter.password
+      end
+    end
+
+    if @voter and @election
+      # initialize things if the vote is blank
+      if @voter.vote.nil?
+        @voter.vote = Vote.new 
+        @voter.save
+      end
+    
+      @voter.vote.set_defaults! if @voter.vote.rankings.empty?
+
+      # if the election is now finished 
+      if @election.enddate < Time.now
+        redirect_to :action => :results, :id => @password
+      else
+        @sidebar_content = render_to_string(:partial => 'vote_sidebar')
+        if @election.embeddable? and params[:embed] == "true"
+          # look for custom theme, and assign to instance variabels
+          # for widget use
+          if @election.embed_custom_string
+            @top_bar = SkinPicture.find(:first,
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "top_bar.png"])
+            @default_image = SkinPicture.find(:first,
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "default_image.png"])
+            @bg1 = SkinPicture.find(:first,
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bg1.png"])
+            @bg2 = SkinPicture.find(:first,
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bg2.png"])
+            @bottom_bar = SkinPicture.find(:first,
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bottom_bar.png"])
+          end
+          render :template => 'embed/full_vote', :layout => 'embed'
+        else
+          render :action => 'full_vote'
+        end
+      end
+    end
+  end
+
+  def login
+    if params[:vote] and params[:vote][:password]
+      redirect_to votepassword_url(:action => 'index',
+        :urlpassword => params[:vote][:password])
+    else
+      redirect_to :action => 'index'

     end
   end
   
   def review
     end
   end
   
   def review

-    if authenticate
-      # remove any existing votes and reload
-      if @voter.vote
-        @voter.vote.destroy
-        @voter.reload
+    @voter.vote.time = Time.now
+    @voter.vote.save
+    @voter.reload
+  end
+
+  def confirm
+    if @voter.vote.confirm!
+      if @voter.election.embeddable? and params[:embed] == "true" \
+        and @voter.election.early_results?
+        redirect_to :action => :results, :id => @password, :embed => 'true'
+      elsif not(@voter.election.verifiable) \
+        and @voter.election.kiosk and params[:kiosk] == "true"
+        redirect_to :action => "kiosk_ready", :id => @password, :kiosk => true
+      else
+        render :action => 'thanks'

       end
       end

-    
-      @vote = Vote.new
-      @voter.vote = @vote
-      @vote.votestring = params[:vote][:votestring] 
-      @vote.save

     else
       redirect_to :action => 'index'
     end
   end
     else
       redirect_to :action => 'index'
     end
   end

+  
+  def reminder
+    if params[:email]
+      voter_array= FullVoter.find(:all,
+        :conditions => ["email = ?", params[:email]])
+      voter_array.delete_if {|voter| voter.election.active == 0}
+      unless voter_array.empty?
+        VoterNotify.deliver_reminder(voter_array)
+      end
+      render :action => 'reminder_sent'
+    end
+  end
+  
+  def results
+    if authenticate and
+      (@voter.election.early_results? \
+       or @voter.election.enddate < Time.now)
+      
+      @election = @voter.election
+      @sidebar_content = \
+        render_to_string(:partial => 'full_results_sidebar')

 
 

-  def confirm
-    if authenticate
-      @voter.vote.confirm!
-      render :action => 'thanks'
+      # look for custom theme, and assign to instance variabels for
+      # widget use
+      if @election.embed_custom_string
+        @top_bar = SkinPicture.find(:first,
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "top_bar.png"])
+        @default_image = SkinPicture.find(:first,
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "default_image.png"])
+        @bg1 = SkinPicture.find(:first,
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bg1.png"])
+        @bg2 = SkinPicture.find(:first,
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bg2.png"])
+        @bottom_bar = SkinPicture.find(:first,
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bottom_bar.png"])
+      end
+      if @election.embeddable? and params[:embed] == "true"
+        render :template => 'embed/results', :layout => 'embed'
+      else
+        render :template => 'common/results'
+      end

     else
       redirect_to :action => 'index'
     end
   end
     else
       redirect_to :action => 'index'
     end
   end

+ 
+  def pref_tables
+    @election = @voter.election
+    render :template => 'common/pref_tables_wrapper', :layout => 'basic'
+  end
+
+  def details
+    @election = @voter.election
+    render :template => 'common/details'
+  end
+
+  def kiosk_ready
+    reset_session
+
+    if not authenticate
+      redirect_to :action => 'index'
+    end
+  end

 
   private
   def authenticate
     password = params[:id]
 
   private
   def authenticate
     password = params[:id]

-    @voter = FullVoter.find(:all, :conditions => [ "password = ?", password ] )[0]
+    if password == "open"
+      election = Election.find(params[:format])
+
+      # if it's not actually open, lets redirect
+      if election.authenticated
+        redirect_to :action => 'index'
+      
+      # otherwise, lets see if they've before
+      else
+        @voter = OpenVoter.find(:all,
+          :conditions => ["session_id = ? and election_id = ?",
+                          session.session_id, election.id])[0]
+
+        # when (a) there is no voter or (b) when there is a voter but
+        # it's kiosk mode on the right page, rewrite with a blank voter
+        if ((not @voter) and  (election.enddate < Time.now)) \
+          or (params[:action] == 'kiosk_ready' and election.kiosk)
+          @voter = OpenVoter.new unless @voter
+        end
+
+        # now that we have a voter (one way or another), set things
+        # right
+        @voter.election = election
+        @voter.session_id = session.session_id
+        @password = "open." + election.id.to_s
+      end
+
+    else
+      @voter = FullVoter.find(:all,
+        :conditions => [ "password = ?", password ] )[0]
+
+      if @voter
+        @password = @voter.password
+      else
+        redirect_to :Action => 'index'
+      end
+    end

   end
 end
 
   end
 end