fix security issue

[selectricity] / app / models / election.rb

diff --git a/app/models/election.rb b/app/models/election.rb
index d76c13f633cd7ddb7b48ca560deb60d54f266d4a..7c15dcfcd785298c1e524702801d69fdfd4f3147 100644 (file)
--- a/app/models/election.rb
+++ b/app/models/election.rb
@@ -1,3 +1,21 @@
+# Selectricity: Voting Machinery for the Masses
+# Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
+# Copyright (C) 2007 Massachusetts Institute of Technology
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see
+# <http://www.gnu.org/licenses/>.
+

 class Election < ActiveRecord::Base
   has_many :candidates
   has_many :voters
 class Election < ActiveRecord::Base
   has_many :candidates
   has_many :voters


@@ -5,27 +23,33 @@ class Election < ActiveRecord::Base
   belongs_to :user
   validates_presence_of :name, :description
   
   belongs_to :user
   validates_presence_of :name, :description
   

+  #validate that method is one of the listed election types
+  

   attr_reader :plurality_result
   attr_reader :approval_result
   attr_reader :condorcet_result
   attr_reader :ssd_result
   attr_reader :borda_result
   attr_reader :plurality_result
   attr_reader :approval_result
   attr_reader :condorcet_result
   attr_reader :ssd_result
   attr_reader :borda_result

-
+  

   require 'date'
   require 'date'

-
-  def startdate
-    read_attribute( :startdate ) || Time.now
-  end

   
   

-  def enddate
-    date = read_attribute( :enddate ) || Time.now + 14
-    date - 1.second
+  def initialize(params={})
+    super
+    self.enddate = read_attribute( :enddate ) || \
+                   Time.now + 30.days - 1.second
+  end
+
+  def other_methods
+    if election_method
+      @other_methods = ELECTION_TYPES.keys.reject {|i| i == election_method}
+    else
+      @other_methods = nil
+    end
+    @other_methods

   end
 
   end
 

-  def enddate=(date)
-    date += 1.day
-    date = Time.gm(*date)
-    super(date)
+  def startdate
+    read_attribute( :startdate ) || Time.now

   end
 
   def votes
   end
 
   def votes


@@ -45,12 +69,11 @@ class Election < ActiveRecord::Base
 
   def start_blockers
     reasons = []
 
   def start_blockers
     reasons = []

-    

     if self.candidates.length <= 1
       reasons << "You must have at least two candidates."
     end
     
     if self.candidates.length <= 1
       reasons << "You must have at least two candidates."
     end
     

-    if self.voters.length <= 1
+    if self.voters.length <= 1 and self.authenticated?

       reasons << "You must have at least two voters."
     end
 
       reasons << "You must have at least two voters."
     end
 


@@ -63,7 +86,7 @@ class Election < ActiveRecord::Base
   end
   
   def quickvote?
   end
   
   def quickvote?

-    self.class == 'QuickVote'
+    self.class == QuickVote

   end
 
   def active?
   end
 
   def active?


@@ -74,6 +97,10 @@ class Election < ActiveRecord::Base
     active == 2
   end
 
     active == 2
   end
 

+  def authenticated?
+    authenticated
+  end
+  

   def shortdesc
     shortdesc = description.split(/\n/)[0]
   end
   def shortdesc
     shortdesc = description.split(/\n/)[0]
   end


@@ -83,8 +110,28 @@ class Election < ActiveRecord::Base
     longdesc.length > 0 ? longdesc : nil 
   end
   
     longdesc.length > 0 ? longdesc : nil 
   end
   

-  #Calculate Election Results
+  #Calculate results if not in memcache

   def results
   def results

+    # Assignment is intentional
+    if Cache and c = Cache.get("election_results:#{id}:#{self.votes.length}")
+      @plurality_result = c['plurality']
+      @approval_result = c['approval']
+      @condorcet_result = c['condorcet']
+      @ssd_result = c['ssd']
+      @borda_result = c['borda']
+      return c
+    elsif Cache
+      # memcache is available, but missed.
+      results = self.results!
+      Cache.set("election_results:#{id}:#{self.votes.length}", results)
+      return results
+    else
+      return self.results!
+    end
+  end
+
+  #Always Calculate Election Results
+  def results!

     # initalize the tallies to empty arrays
     preference_tally = Array.new
     plurality_tally = Array.new
     # initalize the tallies to empty arrays
     preference_tally = Array.new
     plurality_tally = Array.new


@@ -94,21 +141,25 @@ class Election < ActiveRecord::Base
       # skip if the voter has not voted or has an unconfirmed vote
       next unless voter.voted?
 
       # skip if the voter has not voted or has an unconfirmed vote
       next unless voter.voted?
 

-      plurality_tally << voter.vote.rankings.sort[0].candidate.id
+      plurality_tally << voter.vote.rankings.sort[0].candidate_id

       approval_tally << voter.vote.rankings.sort[0..1].collect \
       approval_tally << voter.vote.rankings.sort[0..1].collect \

-        { |ranking| ranking.candidate.id }
+        { |ranking| ranking.candidate_id }

       preference_tally << voter.vote.rankings.sort.collect \
       preference_tally << voter.vote.rankings.sort.collect \

-        { |ranking| ranking.candidate.id }
+        { |ranking| ranking.candidate_id }

     end
     end

+    

     @plurality_result = PluralityVote.new(plurality_tally).result
     @approval_result = ApprovalVote.new(approval_tally).result
     @condorcet_result = PureCondorcetVote.new(preference_tally).result
     @ssd_result = CloneproofSSDVote.new(preference_tally).result
     @borda_result = BordaVote.new(preference_tally).result
     @plurality_result = PluralityVote.new(plurality_tally).result
     @approval_result = ApprovalVote.new(approval_tally).result
     @condorcet_result = PureCondorcetVote.new(preference_tally).result
     @ssd_result = CloneproofSSDVote.new(preference_tally).result
     @borda_result = BordaVote.new(preference_tally).result

-    #@runoff_result = InstantRunoffVote.new(preference_tally).result

     
     

-    nil # to stay consistent
-  end
+    { 'plurality' => @plurality_result,
+      'approval' => @approval_result,
+      'condorcet' => @condorcet_result,
+      'ssd' => @ssd_result,
+      'borda' => @borda_result }
+    end

   
   def names_by_id
     names = Hash.new
   
   def names_by_id
     names = Hash.new


@@ -120,7 +171,6 @@ class Election < ActiveRecord::Base
     
     names
   end
     
     names
   end

-  

 end
 
 
 end