]> projects.mako.cc - selectricity/blobdiff - app/controllers/voter_controller.rb
fix security issue
[selectricity] / app / controllers / voter_controller.rb
index d7f589db7f9d0b1d2e62d4806e11db686fd67ed3..a550f676cc3d2ced5c851eef5c4f4c8632363159 100644 (file)
@@ -2,19 +2,8 @@
 # Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
 # Copyright (C) 2007 Massachusetts Institute of Technology
 #
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public
-# License along with this program.  If not, see
-# <http://www.gnu.org/licenses/>.
+# This program is free software. Please see the COPYING file for
+# details.
 
 class VoterController < ApplicationController
   helper :sparklines
@@ -23,6 +12,9 @@ class VoterController < ApplicationController
   require_dependency "vote"
   require_dependency "election"
 
+  before_filter :authenticate, :except => [:index, :login, :reminder,
+                                           :kiosk_ready, :sort_candidates]
+
   def index
     if params[:election_id]
       @election = Election.find(params[:election_id])
@@ -30,7 +22,7 @@ class VoterController < ApplicationController
         @voter = OpenVoter.find(:all,
           :conditions => ["session_id = ? and election_id = ?",
           session.session_id, @election.id])[0]
-      
+     
         @voter = OpenVoter.new unless @voter
 
         @voter.election = @election
@@ -62,18 +54,24 @@ class VoterController < ApplicationController
       else
         @sidebar_content = render_to_string(:partial => 'vote_sidebar')
         if @election.embeddable? and params[:embed] == "true"
-          #look for custom theme, and assign to instance variabels for widget use
+          # look for custom theme, and assign to instance variabels
+          # for widget use
           if @election.embed_custom_string
             @top_bar = SkinPicture.find(:first,
-            :conditions => ["filename = ?", @election.embed_custom_string + "top_bar.png"])
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "top_bar.png"])
             @default_image = SkinPicture.find(:first,
-            :conditions => ["filename = ?", @election.embed_custom_string + "default_image.png"])
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "default_image.png"])
             @bg1 = SkinPicture.find(:first,
-            :conditions => ["filename = ?", @election.embed_custom_string + "bg1.png"])
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bg1.png"])
             @bg2 = SkinPicture.find(:first,
-            :conditions => ["filename = ?", @election.embed_custom_string + "bg2.png"])
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bg2.png"])
             @bottom_bar = SkinPicture.find(:first,
-            :conditions => ["filename = ?", @election.embed_custom_string + "bottom_bar.png"])
+              :conditions => ["filename = ?",
+                @election.embed_custom_string + "bottom_bar.png"])
           end
           render :template => 'embed/full_vote', :layout => 'embed'
         else
@@ -85,53 +83,27 @@ class VoterController < ApplicationController
 
   def login
     if params[:vote] and params[:vote][:password]
-      redirect_to votepassword_url( :action => 'index', :urlpassword => params[:vote][:password])
+      redirect_to votepassword_url(:action => 'index',
+        :urlpassword => params[:vote][:password])
     else
       redirect_to :action => 'index'
     end
   end
   
-  def pref_tables
-    if authenticate
-      @election = @voter.election
-      @results = @election.results
-      @candidates = {}
-      @election.candidates.each {|c| @candidates[c.id] = c}
-      @names = @election.names_by_id
-      render :template => 'common/pref_tables', :layout => 'basic'
-    else
-      redirect_to :action => 'index'
-    end
-  end
-
-  def details
-    if authenticate
-      @election = @voter.election
-      @votes = @election.votes.select {|v| v.confirmed? }.shuffle
-      @voters = @votes.collect {|v| v.voter}.shuffle
-      render :action => 'details'
-    else
-      redirect_to :action => 'index'
-    end
-  end
-
   def review
-    if authenticate
-      @voter.vote.time = Time.now
-      @voter.vote.save
-      @voter.reload
-    else
-      redirect_to :action => 'index'
-    end
+    @voter.vote.time = Time.now
+    @voter.vote.save
+    @voter.reload
   end
 
   def confirm
-    if authenticate
-      @voter.vote.confirm!
-
+    if @voter.vote.confirm!
       if @voter.election.embeddable? and params[:embed] == "true" \
         and @voter.election.early_results?
         redirect_to :action => :results, :id => @password, :embed => 'true'
+      elsif not(@voter.election.verifiable) \
+        and @voter.election.kiosk and params[:kiosk] == "true"
+        redirect_to :action => "kiosk_ready", :id => @password, :kiosk => true
       else
         render :action => 'thanks'
       end
@@ -142,7 +114,8 @@ class VoterController < ApplicationController
   
   def reminder
     if params[:email]
-      voter_array= FullVoter.find(:all, :conditions => ["email = ?", params[:email]])
+      voter_array= FullVoter.find(:all,
+        :conditions => ["email = ?", params[:email]])
       voter_array.delete_if {|voter| voter.election.active == 0}
       unless voter_array.empty?
         VoterNotify.deliver_reminder(voter_array)
@@ -157,54 +130,96 @@ class VoterController < ApplicationController
        or @voter.election.enddate < Time.now)
       
       @election = @voter.election
-      # compute and display results
-
-      @results = @election.results
-      @candidates = {}
-      @election.candidates.each {|c| @candidates[c.id] = c}
-      @names = @election.names_by_id
-        
-      @sidebar_content = render_to_string(:partial => 'results_sidebar')
-      #look for custom theme, and assign to instance variabels for widget use
+      @sidebar_content = \
+        render_to_string(:partial => 'full_results_sidebar')
+
+      # look for custom theme, and assign to instance variabels for
+      # widget use
       if @election.embed_custom_string
         @top_bar = SkinPicture.find(:first,
-        :conditions => ["filename = ?", @election.embed_custom_string + "top_bar.png"])
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "top_bar.png"])
         @default_image = SkinPicture.find(:first,
-        :conditions => ["filename = ?", @election.embed_custom_string + "default_image.png"])
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "default_image.png"])
         @bg1 = SkinPicture.find(:first,
-        :conditions => ["filename = ?", @election.embed_custom_string + "bg1.png"])
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bg1.png"])
         @bg2 = SkinPicture.find(:first,
-        :conditions => ["filename = ?", @election.embed_custom_string + "bg2.png"])
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bg2.png"])
         @bottom_bar = SkinPicture.find(:first,
-        :conditions => ["filename = ?", @election.embed_custom_string + "bottom_bar.png"])
+          :conditions => ["filename = ?",
+            @election.embed_custom_string + "bottom_bar.png"])
       end
       if @election.embeddable? and params[:embed] == "true"
         render :template => 'embed/results', :layout => 'embed'
       else
-        render :action => 'results'
+        render :template => 'common/results'
       end
     else
       redirect_to :action => 'index'
     end
   end
-  
+  def pref_tables
+    @election = @voter.election
+    render :template => 'common/pref_tables_wrapper', :layout => 'basic'
+  end
+
+  def details
+    @election = @voter.election
+    render :template => 'common/details'
+  end
+
+  def kiosk_ready
+    reset_session
+
+    if not authenticate
+      redirect_to :action => 'index'
+    end
+  end
+
   private
   def authenticate
     password = params[:id]
     if password == "open"
       election = Election.find(params[:format])
-      unless election.authenticated?
+
+      # if it's not actually open, lets redirect
+      if election.authenticated
+        redirect_to :action => 'index'
+      
+      # otherwise, lets see if they've before
+      else
         @voter = OpenVoter.find(:all,
           :conditions => ["session_id = ? and election_id = ?",
                           session.session_id, election.id])[0]
+
+        # when (a) there is no voter or (b) when there is a voter but
+        # it's kiosk mode on the right page, rewrite with a blank voter
+        if ((not @voter) and  (election.enddate < Time.now)) \
+          or (params[:action] == 'kiosk_ready' and election.kiosk)
+          @voter = OpenVoter.new unless @voter
+        end
+
+        # now that we have a voter (one way or another), set things
+        # right
+        @voter.election = election
+        @voter.session_id = session.session_id
         @password = "open." + election.id.to_s
       end
+
     else
       @voter = FullVoter.find(:all,
         :conditions => [ "password = ?", password ] )[0]
-      @password = @voter.password
+
+      if @voter
+        @password = @voter.password
+      else
+        redirect_to :Action => 'index'
+      end
     end
-    @voter
   end
 end
 

Benjamin Mako Hill || Want to submit a patch?