chaas/debshots
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Authorisation management using CanCanCan added

Browse source
This commit is contained in:
Christoph Haas 2021-02-28 21:36:46 +01:00
parent 51be4a4777
commit 7a3b65fe50
24 changed files with 211 additions and 295 deletions
Download patch file Download diff file Expand all files Collapse all files

50
app/controllers/admin_controller.rb
View file

@ -1,38 +1,38 @@
class AdminController < ApplicationController
before_action :authenticate_user!
before_action :admin_only
# before_action :authenticate_user!
# before_action :admin_only
def status
end
# def status
# end
def screenshots
end
# def screenshots
# end
def integration
end
# def integration
# end
def moderate_list
end
# def moderate_list
# end
def logs
logs = Log
# def logs
# logs = Log
if params[:search].present?
logger.debug "Searching for #{params[:search]}"
logs = logs.where("message ilike ?", "%#{params[:search]}%")
end
# if params[:search].present?
# logger.debug "Searching for #{params[:search]}"
# logs = logs.where("message ilike ?", "%#{params[:search]}%")
# end
@logs = logs.paginate(page: params[:page], per_page: 20)
end
# @logs = logs.paginate(page: params[:page], per_page: 20)
# end
private
# private
def admin_only
unless current_user.is_admin?
head :forbidden
# redirect_to :back, :alert => "Access denied."
end
end
# def admin_only
# unless current_user.is_admin?
# head :forbidden
# # redirect_to :back, :alert => "Access denied."
# end
# end
end

2
app/controllers/application_controller.rb
View file

@ -22,7 +22,7 @@ class ApplicationController < ActionController::Base
# the navigation bar that contains a paginator of packages that contain
# screenshots that require moderation.
def moderate_packages
if user_signed_in? and current_user.is_admin? and Package.need_moderation.any?
if can? :approve, Screenshot and Package.need_moderation.any?
@moderate_packages = Package.need_moderation
end
end

41
app/controllers/moderate_controller.rb
View file

@ -1,27 +1,22 @@
class ModerateController < ApplicationController
# class ModerateController < ApplicationController
before_action :authenticate_user!
# before_action :authenticate_user!
def index
# First package with pending screenshots
@package = Package.joins(:screenshots).where('screenshots.approved=false or screenshots.markedfordelete=true').distinct(:name).first
# def index
# # First package with pending screenshots
# @package = Package.joins(:screenshots).where('screenshots.approved=false').distinct(:name).first
# # List of screenshots that were reported (to be removed)
# @reported_screenshots = Screenshot.where(markedfordelete: true)
# # First package with reported screenshots
# @reported_package = Package.joins(:screenshots).where('screenshots.markedfordelete=true').distinct(:name).first
# if @package
# # List of screenshots to be moderated
# @pending_screenshots = @package.screenshots_pending
# # Number of screenshots that were already moderated (during this session)
# session[:already_moderated] ||= 0
# @moderated_screenshots = session[:already_moderated]
if @package
# List of screenshots to be moderated
@pending_screenshots = @package.screenshots_pending
# Number of screenshots that were already moderated (during this session)
session[:already_moderated] ||= 0
@moderated_screenshots = session[:already_moderated]
# BUG: calculation is wrong when pending and reported screenshots are in the queue
# Percentage of already moderated screenshots
@percent_moderated = 100 * (@moderated_screenshots+1) / (@moderated_screenshots + @pending_screenshots.count)
# @percent_moderated = 100 * (@moderated_screenshots+1) / (@moderated_screenshots + @pending_screenshots.count + @reported_screenshots.count)
end
end
end
# # BUG: calculation is wrong when pending and reported screenshots are in the queue
# # Percentage of already moderated screenshots
# @percent_moderated = 100 * (@moderated_screenshots+1) / (@moderated_screenshots + @pending_screenshots.count)
# # @percent_moderated = 100 * (@moderated_screenshots+1) / (@moderated_screenshots + @pending_screenshots.count + @reported_screenshots.count)
# end
# end
# end

80
app/controllers/packages_controller.rb
View file

@ -37,10 +37,6 @@ class PackagesController < ApplicationController
# This action saves the screenshots already if they are valid. The user is
# then given the chance to comment on and delete the screenshots again.
def upload_receive
# Create a pseudo user account for the user.
# The user won't know that an account is created.
# But this makes it easier to track who screenshots belong to.
# User.create_pseudo_user unless user_signed_in?
@package = Package.find_by!(name: params[:name])
@valid_images = []
@invalid_images = []
@ -65,7 +61,7 @@ class PackagesController < ApplicationController
# Check if the image was valid
if new_screenshot.valid?
new_screenshot.uploaderhash = session.id.to_s
# new_screenshot.uploaderhash = session.id.to_s
new_screenshot.uploaderip = request.remote_ip
new_screenshot.version = @package.version
# ActiveStorage does not yet create a file checksum automatically.
@ -77,19 +73,25 @@ class PackagesController < ApplicationController
Log.log "Duplicate image with fingerprint #{new_screenshot.image_fingerprint} found. Rejecting."
all_errors << "Your file #{img.original_filename} is a duplicate. Sorry."
else
# Can the upload get approved automatically?
if user_signed_in?
new_screenshot.user = current_user
new_screenshot.approve! if auto_approve?
end
# TODO: Can the upload get approved automatically?
# Create a pseudo user account for the user.
# The user won't know that an account is created.
# But this makes it easier to track who screenshots belong to.
unless user_signed_in?
sign_in User.create_pseudo_user
end
new_screenshot.user = current_user
new_screenshot.approve! if can?(:approve, new_screenshot)
# Pre-render screenshot in different sizes
new_screenshot.simage_derivatives!
Log.log "Derivatives created"
new_screenshot.save!
Log.log "Screenshot #{new_screenshot.id} uploaded successfully. " + \
"ip=#{new_screenshot.uploaderip}. "+ \
"user-hash=#{new_screenshot.uploaderhash}. "+ \
#"user-hash=#{new_screenshot.uploaderhash}. "+ \
"user-name=#{current_user} "+ \
"image-fingerprint=#{new_screenshot.image_fingerprint} "+ \
"image-path=#{img.path}"
@ -174,7 +176,7 @@ class PackagesController < ApplicationController
# Check if the user is allowed to change this screenshot
# - Is this the user's own screenshot? (anonymous)
if @screenshot.user == current_user or current_user.is_admin?
if (@screenshot.user == current_user) || (can? :detroy, @screenshot)
logger.debug "User #{current_user} deletes screenshot #{@screenshot}"
@screenshot.destroy
flash['notice'] = "Screenshot deleted."
@ -185,8 +187,9 @@ class PackagesController < ApplicationController
end
def approve_screenshot
if current_user && current_user.is_admin?
@screenshot = Screenshot.find(params[:id])
@screenshot = Screenshot.find(params[:id])
if can? :approve, @screenshot
@screenshot.approve!
flash['notice'] = "Screenshot approved."
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
@ -263,23 +266,6 @@ class PackagesController < ApplicationController
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
end
# Receive an anonymous report from a user to have a screenshot removed.
# def report_screenshot
# @screenshot = Screenshot.find(params[:id])
# # if verify_recaptcha
# @screenshot.delete_reason = params[:delete_reason]
# @screenshot.markedfordelete = true
# if @screenshot.valid?
# @screenshot.save!
# flash['notice'] = "Screenshot reported. The moderators will deal with it."
# else
# errors = @screenshot.errors.to_a.join(' and ')
# flash['alert'] = "Sorry. #{errors}"
# end
# # end
# redirect_back(fallback_location: package_path)
# end
# Show an HTML partial with reviews of this package from the Ubuntu API
# def reviews
# expires_in 1.day, public: true
@ -350,37 +336,7 @@ class PackagesController < ApplicationController
params.require(:screenshot).permit(:description)
end
# Do uploads from this user get approved automatically?
def auto_approve?
# Anonymous users need to go through moderation
return false unless user_signed_in?
# Admins do not need moderation
return true if current_user.is_admin?
# Debian developers do not need moderation
return true if current_user.provider == 'debian-sso'
# After one successfully approved screenshot users do not need moderation
# return true if current_user.approved_screenshots.count > 0
# Any other user's upload must be moderated
return false
end
def screenshots_visible_to_user(package)
if user_signed_in? and current_user.is_admin?
# User is an admin and can view all screenshots
package.screenshots
# TODO: User logins and assigned screenshots will come in a later version
# elsif user_signed_in?
# package.screenshots.where(id: (current_user.screenshots.select(:id))) | \
# package.screenshots.where(approved: true).order('created_at DESC')
else
package.screenshots.where(uploaderhash: session.id.to_s).or(
package.screenshots.where(approved: true)
)
.order('created_at DESC')
end
package.screenshots.accessible_by(current_ability, :view).order('created_at DESC')
end
end