fix security issue

[selectricity] / app / models / vote.rb

diff --git a/app/models/vote.rb b/app/models/vote.rb
index 62944e3301a5b6f07f77f475e1ef85ae8d314cc6..719aa7b33f9cb7163049b3bc27389d49c4605251 100644 (file)
--- a/app/models/vote.rb
+++ b/app/models/vote.rb
@@ -1,3 +1,21 @@
+# Selectricity: Voting Machinery for the Masses
+# Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
+# Copyright (C) 2007 Massachusetts Institute of Technology
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see
+# <http://www.gnu.org/licenses/>.
+

 class Vote < ActiveRecord::Base
   # relationships to other classes
   belongs_to :voter
 class Vote < ActiveRecord::Base
   # relationships to other classes
   belongs_to :voter


@@ -7,9 +25,7 @@ class Vote < ActiveRecord::Base
   # callbacks
   after_update :save_rankings
   before_destroy :destroy_rankings
   # callbacks
   after_update :save_rankings
   before_destroy :destroy_rankings

-

   
   

-

   def to_s
     votes.join("")
   end
   def to_s
     votes.join("")
   end


@@ -23,7 +39,7 @@ class Vote < ActiveRecord::Base
       if rankings.empty?
         @votes = Array.new
       else
       if rankings.empty?
         @votes = Array.new
       else

-        @votes = rankings.sort.collect { |ranking| ranking.candidate.id }
+        @votes = self.rankings.sort.collect { |ranking| ranking.candidate.id }

       end
     end
 
       end
     end
 


@@ -35,6 +51,9 @@ class Vote < ActiveRecord::Base
   end
 
   def save_rankings
   end
 
   def save_rankings

+    self.votes # i need to initalize this before destroying rankings
+               # or else the ranks themselves show up as nil
+

     destroy_rankings
     self.votes.each_with_index do |candidate_id, index| 
       ranking = Ranking.new
     destroy_rankings
     self.votes.each_with_index do |candidate_id, index| 
       ranking = Ranking.new


@@ -53,19 +72,20 @@ class Vote < ActiveRecord::Base
     rankings.each { |ranking| ranking.destroy }
   end
 
     rankings.each { |ranking| ranking.destroy }
   end
 

-  def settime
-    self.time = Time.now
-    self.save
-  end
-

   def confirm!
   def confirm!

-    self.confirmed = 1
-    self.save
-    
-    unless self.voter.election.quickvote?
-      token.destroy and token.reload if token
-      self.token = Token.new
+    if self.voter.election.candidates.length == self.rankings.length
+      self.confirmed = 1
+      self.time = Time.now

       self.save
       self.save

+    
+      unless self.voter.election.quickvote?
+        token.destroy and token.reload if token
+        self.token = Token.new
+        self.save
+      end
+      return false
+    else
+      return true

     end
   end
 
     end
   end
 


@@ -73,16 +93,6 @@ class Vote < ActiveRecord::Base
     confirmed == 1
   end
   
     confirmed == 1
   end
   

-  def votestring=(string="")
-    candidate_ids = voter.election.candidates.sort.collect \
-      { |candidate| candidate.id.to_i }
-
-    rel_votes = string.split("").collect { |vote| vote.to_i }
-    
-    # covert relative orders to absolute candidate ids
-    self.votes = rel_votes.collect { |vote| candidate_ids[ vote - 1 ] }
-  end
-

   def votestring
     # create a mapping of candidates ids and the relative order of the
     # candidates as they appear when sorted alphabetically
   def votestring
     # create a mapping of candidates ids and the relative order of the
     # candidates as they appear when sorted alphabetically


@@ -92,14 +102,15 @@ class Vote < ActiveRecord::Base
     end
 
     # assemble the votestring
     end
 
     # assemble the votestring

-    self.votes.collect {|v| cand_relnums[v]}.join("")
+    self.votes.collect {|v| (cand_relnums[v] + 64).chr}.join("")

   end
 
   end
 

-  # the following subroutine is used for quickvotes. it creates a vote
-  # with the candidates listed in order of preference based on
-  # alphabetical order. it is meant to be manipulated and then confirmed
-  def set_defaults!
-    self.votes =  voter.election.candidates.sort.collect {|c| c.id }
+  # the following subroutine is used for quickvotes, but need for elections now
+  # too. It creates a vote with the candidates listed in order of preference 
+  # based on alphabetical order. Meant to be manipulated and then confirmed
+  def set_defaults!  
+    self.votes = self.voter.election.candidates.sort_by { rand }.collect {|c| c.id }

     self.save
   end
     self.save
   end

+         

 end
 end