diff options
Diffstat (limited to 'app/controllers')
18 files changed, 454 insertions, 301 deletions
diff --git a/app/controllers/admin_censor_rule_controller.rb b/app/controllers/admin_censor_rule_controller.rb index 6f79b5ba1..3387fd832 100644 --- a/app/controllers/admin_censor_rule_controller.rb +++ b/app/controllers/admin_censor_rule_controller.rb @@ -5,32 +5,47 @@ # Email: hello@mysociety.org; WWW: http://www.mysociety.org/ class AdminCensorRuleController < AdminController + + before_filter :set_editor, :only => [:create, :update] + before_filter :find_and_check_rule, :only => [:edit, :update, :destroy] + def new - if params[:info_request_id] - @info_request = InfoRequest.find(params[:info_request_id]) + if params[:request_id] + @info_request = InfoRequest.find(params[:request_id]) + @censor_rule = @info_request.censor_rules.build + @form_url = admin_request_censor_rules_path(@info_request) end + if params[:user_id] @censor_user = User.find(params[:user_id]) + @censor_rule = @censor_user.censor_rules.build + @form_url = admin_user_censor_rules_path(@censor_user) end end def create - params[:censor_rule][:last_edit_editor] = admin_current_user() - @censor_rule = CensorRule.new(params[:censor_rule]) + if params[:request_id] + @info_request = InfoRequest.find(params[:request_id]) + @censor_rule = @info_request.censor_rules.build(params[:censor_rule]) + @form_url = admin_request_censor_rules_path(@info_request) + end + + if params[:user_id] + @censor_user = User.find(params[:user_id]) + @censor_rule = @censor_user.censor_rules.build(params[:censor_rule]) + @form_url = admin_user_censor_rules_path(@censor_user) + end + if @censor_rule.save - if !@censor_rule.info_request.nil? + + flash[:notice] = 'CensorRule was successfully created.' + + if @censor_rule.info_request expire_for_request(@censor_rule.info_request) - end - if !@censor_rule.user.nil? + redirect_to admin_request_url(@censor_rule.info_request) + elsif @censor_rule.user expire_requests_for_user(@censor_rule.user) - end - flash[:notice] = 'CensorRule was successfully created.' - if !@censor_rule.info_request.nil? - redirect_to admin_request_show_url(@censor_rule.info_request) - elsif !@censor_rule.user.nil? - redirect_to admin_user_show_url(@censor_rule.user) - else - raise "internal error" + redirect_to admin_user_url(@censor_rule.user) end else render :action => 'new' @@ -38,56 +53,55 @@ class AdminCensorRuleController < AdminController end def edit - @censor_rule = CensorRule.find(params[:id]) end def update - params[:censor_rule][:last_edit_editor] = admin_current_user() - @censor_rule = CensorRule.find(params[:id]) if @censor_rule.update_attributes(params[:censor_rule]) - if !@censor_rule.info_request.nil? + + flash[:notice] = 'CensorRule was successfully updated.' + + if @censor_rule.info_request expire_for_request(@censor_rule.info_request) - end - if !@censor_rule.user.nil? + redirect_to admin_request_url(@censor_rule.info_request) + elsif @censor_rule.user expire_requests_for_user(@censor_rule.user) + redirect_to admin_user_url(@censor_rule.user) end - flash[:notice] = 'CensorRule was successfully updated.' - if !@censor_rule.info_request.nil? - redirect_to admin_request_show_url(@censor_rule.info_request) - elsif !@censor_rule.user.nil? - redirect_to admin_user_show_url(@censor_rule.user) - else - raise "internal error" - end + else render :action => 'edit' end end def destroy - censor_rule = CensorRule.find(params[:censor_rule_id]) - info_request = censor_rule.info_request - user = censor_rule.user + info_request = @censor_rule.info_request + user = @censor_rule.user + @censor_rule.destroy + + flash[:notice] = "CensorRule was successfully destroyed." - censor_rule.destroy - if !info_request.nil? + if info_request expire_for_request(info_request) - end - if !user.nil? - expire_requests_for_user(user) + redirect_to admin_request_url(info_request) + elsif user + expire_requests_for_user(user) if user + redirect_to admin_user_url(user) end - flash[:notice] = "CensorRule was successfully destroyed." - if !info_request.nil? - redirect_to admin_request_show_url(info_request) - elsif !user.nil? - redirect_to admin_user_show_url(user) - else - raise "internal error" - end end private + def set_editor + params[:censor_rule][:last_edit_editor] = admin_current_user + end + + def find_and_check_rule + @censor_rule = CensorRule.find(params[:id]) + unless (@censor_rule.user || @censor_rule.info_request) + flash[:notice] = 'Only user and request censor rules can be edited' + redirect_to admin_general_index_path + end + end end diff --git a/app/controllers/admin_comment_controller.rb b/app/controllers/admin_comment_controller.rb new file mode 100644 index 000000000..0aafb122a --- /dev/null +++ b/app/controllers/admin_comment_controller.rb @@ -0,0 +1,36 @@ +# app/controllers/admin_comment_controller.rb: +# Controller for editing comments from the admin interface. +# +# Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved. +# Email: hello@mysociety.org; WWW: http://www.mysociety.org/ + +class AdminCommentController < AdminController + + def edit + @comment = Comment.find(params[:id]) + end + + def update + @comment = Comment.find(params[:id]) + + old_body = @comment.body + old_visible = @comment.visible + @comment.visible = params[:comment][:visible] == "true" ? true : false + + if @comment.update_attributes(params[:comment]) + @comment.info_request.log_event("edit_comment", + { :comment_id => @comment.id, + :editor => admin_current_user(), + :old_body => old_body, + :body => @comment.body, + :old_visible => old_visible, + :visible => @comment.visible, + }) + flash[:notice] = 'Comment successfully updated.' + redirect_to admin_request_url(@comment.info_request) + else + render :action => 'edit' + end + end + +end diff --git a/app/controllers/admin_holiday_imports_controller.rb b/app/controllers/admin_holiday_imports_controller.rb new file mode 100644 index 000000000..8596936f0 --- /dev/null +++ b/app/controllers/admin_holiday_imports_controller.rb @@ -0,0 +1,28 @@ +class AdminHolidayImportsController < AdminController + + def new + @holiday_import = HolidayImport.new(holiday_import_params) + @holiday_import.populate if @holiday_import.valid? + end + + def create + @holiday_import = HolidayImport.new(holiday_import_params) + if @holiday_import.save + notice = "Holidays successfully imported" + redirect_to admin_holidays_path, :notice => notice + else + render :new + end + end + + private + + def holiday_import_params(key = :holiday_import) + if params[key] + params[key].slice(:holidays_attributes, :start_year, :end_year, :source, :ical_feed_url) + else + {} + end + end + +end diff --git a/app/controllers/admin_holidays_controller.rb b/app/controllers/admin_holidays_controller.rb new file mode 100644 index 000000000..9177ebd44 --- /dev/null +++ b/app/controllers/admin_holidays_controller.rb @@ -0,0 +1,67 @@ +class AdminHolidaysController < AdminController + + def index + get_all_holidays + end + + def new + @holiday = Holiday.new + if request.xhr? + render :partial => 'new_form', :locals => { :holiday => @holiday } + else + render :action => 'new' + end + end + + def create + @holiday = Holiday.new(holiday_params) + if @holiday.save + notice = "Holiday successfully created." + redirect_to admin_holidays_path, :notice => notice + else + render :new + end + end + + def edit + @holiday = Holiday.find(params[:id]) + if request.xhr? + render :partial => 'edit_form' + else + render :action => 'edit' + end + end + + def update + @holiday = Holiday.find(params[:id]) + if @holiday.update_attributes(holiday_params) + flash[:notice] = 'Holiday successfully updated.' + redirect_to admin_holidays_path + else + render :edit + end + end + + def destroy + @holiday = Holiday.find(params[:id]) + @holiday.destroy + notice = "Holiday successfully destroyed" + redirect_to admin_holidays_path, :notice => notice + end + + private + + def get_all_holidays + @holidays_by_year = Holiday.all.group_by { |holiday| holiday.day.year } + @years = @holidays_by_year.keys.sort.reverse + end + + def holiday_params(key = :holiday) + if params[key] + params[key].slice(:description, 'day(1i)', 'day(2i)', 'day(3i)') + else + {} + end + end + +end diff --git a/app/controllers/admin_incoming_message_controller.rb b/app/controllers/admin_incoming_message_controller.rb index 6b50d0e36..bc653bf53 100644 --- a/app/controllers/admin_incoming_message_controller.rb +++ b/app/controllers/admin_incoming_message_controller.rb @@ -20,14 +20,14 @@ class AdminIncomingMessageController < AdminController :prominence_reason => @incoming_message.prominence_reason) expire_for_request(@incoming_message.info_request) flash[:notice] = 'Incoming message successfully updated.' - redirect_to admin_request_show_url(@incoming_message.info_request) + redirect_to admin_request_url(@incoming_message.info_request) else render :action => 'edit' end end def destroy - @incoming_message = IncomingMessage.find(params[:incoming_message_id]) + @incoming_message = IncomingMessage.find(params[:id]) @info_request = @incoming_message.info_request incoming_message_id = @incoming_message.id @@ -37,11 +37,11 @@ class AdminIncomingMessageController < AdminController # expire cached files expire_for_request(@info_request) flash[:notice] = 'Incoming message successfully destroyed.' - redirect_to admin_request_show_url(@info_request) + redirect_to admin_request_url(@info_request) end def redeliver - incoming_message = IncomingMessage.find(params[:redeliver_incoming_message_id]) + incoming_message = IncomingMessage.find(params[:id]) message_ids = params[:url_title].split(",").each {|x| x.strip} previous_request = incoming_message.info_request destination_request = nil @@ -54,7 +54,7 @@ class AdminIncomingMessageController < AdminController end if destination_request.nil? flash[:error] = "Failed to find destination request '" + m + "'" - return redirect_to admin_request_show_url(previous_request) + return redirect_to admin_request_url(previous_request) end raw_email_data = incoming_message.raw_email.data @@ -74,7 +74,7 @@ class AdminIncomingMessageController < AdminController expire_for_request(previous_request) incoming_message.fully_destroy end - redirect_to admin_request_show_url(destination_request) + redirect_to admin_request_url(destination_request) end end diff --git a/app/controllers/admin_info_request_event_controller.rb b/app/controllers/admin_info_request_event_controller.rb new file mode 100644 index 000000000..17d147582 --- /dev/null +++ b/app/controllers/admin_info_request_event_controller.rb @@ -0,0 +1,24 @@ +# app/controllers/admin_info_request_event_controller.rb: +# Controller for FOI request event manipulation from the admin interface. +# +# Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved. +# Email: hello@mysociety.org; WWW: http://www.mysociety.org/ + +class AdminInfoRequestEventController < AdminController + + # used so due dates get fixed + def update + @info_request_event = InfoRequestEvent.find(params[:id]) + if @info_request_event.event_type != 'response' + raise Exception("can only mark responses as requires clarification") + end + @info_request_event.described_state = 'waiting_clarification' + @info_request_event.calculated_state = 'waiting_clarification' + # TODO: deliberately don't update described_at so doesn't reenter search? + @info_request_event.save! + + flash[:notice] = "Old response marked as having been a clarification" + redirect_to admin_request_url(@info_request_event.info_request) + end + +end diff --git a/app/controllers/admin_outgoing_message_controller.rb b/app/controllers/admin_outgoing_message_controller.rb index ec0981677..2ee811dc0 100644 --- a/app/controllers/admin_outgoing_message_controller.rb +++ b/app/controllers/admin_outgoing_message_controller.rb @@ -5,7 +5,7 @@ class AdminOutgoingMessageController < AdminController end def destroy - @outgoing_message = OutgoingMessage.find(params[:outgoing_message_id]) + @outgoing_message = OutgoingMessage.find(params[:id]) @info_request = @outgoing_message.info_request outgoing_message_id = @outgoing_message.id @@ -14,7 +14,7 @@ class AdminOutgoingMessageController < AdminController { :editor => admin_current_user(), :deleted_outgoing_message_id => outgoing_message_id }) flash[:notice] = 'Outgoing message successfully destroyed.' - redirect_to admin_request_show_url(@info_request) + redirect_to admin_request_url(@info_request) end def update @@ -38,10 +38,41 @@ class AdminOutgoingMessageController < AdminController :prominence_reason => @outgoing_message.prominence_reason }) flash[:notice] = 'Outgoing message successfully updated.' expire_for_request(@outgoing_message.info_request) - redirect_to admin_request_show_url(@outgoing_message.info_request) + redirect_to admin_request_url(@outgoing_message.info_request) else render :action => 'edit' end end + def resend + @outgoing_message = OutgoingMessage.find(params[:id]) + @outgoing_message.prepare_message_for_resend + + mail_message = case @outgoing_message.message_type + when 'initial_request' + OutgoingMailer.initial_request( + @outgoing_message.info_request, + @outgoing_message + ).deliver + when 'followup' + OutgoingMailer.followup( + @outgoing_message.info_request, + @outgoing_message, + @outgoing_message.incoming_message_followup + ).deliver + else + raise "Message id #{id} has type '#{message_type}' which cannot be resent" + end + + @outgoing_message.record_email_delivery( + mail_message.to_addrs.join(', '), + mail_message.message_id, + 'resent' + ) + + flash[:notice] = "Outgoing message resent" + redirect_to admin_request_url(@outgoing_message.info_request) + end + + end diff --git a/app/controllers/admin_public_body_categories_controller.rb b/app/controllers/admin_public_body_categories_controller.rb index fda09fa4a..5e305dde3 100644 --- a/app/controllers/admin_public_body_categories_controller.rb +++ b/app/controllers/admin_public_body_categories_controller.rb @@ -22,7 +22,8 @@ class AdminPublicBodyCategoriesController < AdminController I18n.with_locale(I18n.default_locale) do if params[:public_body_category][:category_tag] && PublicBody.find_by_tag(@category.category_tag).count > 0 && @category.category_tag != params[:public_body_category][:category_tag] - flash[:notice] = 'There are authorities associated with this category, so the tag can\'t be renamed' + flash[:error] = "There are authorities associated with this category, so the tag can't be renamed" + render :action => 'edit' else if params[:headings] heading_ids = params[:headings].values @@ -48,10 +49,11 @@ class AdminPublicBodyCategoriesController < AdminController if @category.update_attributes(params[:public_body_category]) flash[:notice] = 'Category was successfully updated.' + redirect_to edit_admin_category_path(@category) + else + render :action => 'edit' end end - - render :action => 'edit' end end diff --git a/app/controllers/admin_public_body_controller.rb b/app/controllers/admin_public_body_controller.rb index f7a80476c..cfb6f240d 100644 --- a/app/controllers/admin_public_body_controller.rb +++ b/app/controllers/admin_public_body_controller.rb @@ -5,69 +5,9 @@ # Email: hello@mysociety.org; WWW: http://www.mysociety.org/ class AdminPublicBodyController < AdminController - def index - list - render :action => 'list' - end - - def _lookup_query_internal - @locale = self.locale_from_params() - underscore_locale = @locale.gsub '-', '_' - I18n.with_locale(@locale) do - @query = params[:query] - if @query == "" - @query = nil - end - @page = params[:page] - if @page == "" - @page = nil - end - @public_bodies = PublicBody.joins(:translations).where(@query.nil? ? "public_body_translations.locale = '#{underscore_locale}'" : - ["(lower(public_body_translations.name) like lower('%'||?||'%') or - lower(public_body_translations.short_name) like lower('%'||?||'%') or - lower(public_body_translations.request_email) like lower('%'||?||'%' )) AND (public_body_translations.locale = '#{underscore_locale}')", @query, @query, @query]).paginate :order => "public_body_translations.name", :page => @page, :per_page => 100 - end - @public_bodies_by_tag = PublicBody.find_by_tag(@query) - end - def list - self._lookup_query_internal - end - - def mass_tag_add - self._lookup_query_internal - - if params[:new_tag] and params[:new_tag] != "" - if params[:table_name] == 'exact' - bodies = @public_bodies_by_tag - elsif params[:table_name] == 'substring' - bodies = @public_bodies - else - raise "Unknown table_name " + params[:table_name] - end - for body in bodies - body.add_tag_if_not_already_present(params[:new_tag]) - end - flash[:notice] = "Added tag to table of bodies." - end - - redirect_to admin_body_list_url(:query => @query, :page => @page) - end - - def missing_scheme - # There might be a way to do this in ActiveRecord, but I can't find it - @public_bodies = PublicBody.find_by_sql(" - SELECT a.id, a.name, a.url_name, COUNT(*) AS howmany - FROM public_bodies a JOIN info_requests r ON a.id = r.public_body_id - WHERE a.publication_scheme = '' - GROUP BY a.id, a.name, a.url_name - ORDER BY howmany DESC - LIMIT 20 - ") - @stats = { - "total" => PublicBody.count, - "entered" => PublicBody.count(:conditions => "publication_scheme != ''") - } + def index + lookup_query end def show @@ -111,7 +51,7 @@ class AdminPublicBodyController < AdminController @change_request.send_response(params[:subject], response_text) end flash[:notice] = 'PublicBody was successfully created.' - redirect_to admin_body_show_url(@public_body) + redirect_to admin_body_url(@public_body) else render :action => 'new' end @@ -147,7 +87,7 @@ class AdminPublicBodyController < AdminController @change_request.send_response(params[:subject], params[:response]) end flash[:notice] = 'PublicBody was successfully updated.' - redirect_to admin_body_show_url(@public_body) + redirect_to admin_body_url(@public_body) else render :action => 'edit' end @@ -161,17 +101,53 @@ class AdminPublicBodyController < AdminController if public_body.info_requests.size > 0 flash[:notice] = "There are requests associated with the authority, so can't destroy it" - redirect_to admin_body_show_url(public_body) + redirect_to admin_body_url(public_body) return end public_body.tag_string = "" public_body.destroy flash[:notice] = "PublicBody was successfully destroyed." - redirect_to admin_body_list_url + redirect_to admin_bodies_url end end + def mass_tag_add + lookup_query + + if params[:new_tag] and params[:new_tag] != "" + if params[:table_name] == 'exact' + bodies = @public_bodies_by_tag + elsif params[:table_name] == 'substring' + bodies = @public_bodies + else + raise "Unknown table_name " + params[:table_name] + end + for body in bodies + body.add_tag_if_not_already_present(params[:new_tag]) + end + flash[:notice] = "Added tag to table of bodies." + end + + redirect_to admin_bodies_url(:query => @query, :page => @page) + end + + def missing_scheme + # There might be a way to do this in ActiveRecord, but I can't find it + @public_bodies = PublicBody.find_by_sql(" + SELECT a.id, a.name, a.url_name, COUNT(*) AS howmany + FROM public_bodies a JOIN info_requests r ON a.id = r.public_body_id + WHERE a.publication_scheme = '' + GROUP BY a.id, a.name, a.url_name + ORDER BY howmany DESC + LIMIT 20 + ") + @stats = { + "total" => PublicBody.count, + "entered" => PublicBody.count(:conditions => "publication_scheme != ''") + } + end + def import_csv @notes = "" @errors = "" @@ -251,4 +227,24 @@ class AdminPublicBodyController < AdminController return csv_contents end + def lookup_query + @locale = self.locale_from_params() + underscore_locale = @locale.gsub '-', '_' + I18n.with_locale(@locale) do + @query = params[:query] + if @query == "" + @query = nil + end + @page = params[:page] + if @page == "" + @page = nil + end + @public_bodies = PublicBody.joins(:translations).where(@query.nil? ? "public_body_translations.locale = '#{underscore_locale}'" : + ["(lower(public_body_translations.name) like lower('%'||?||'%') or + lower(public_body_translations.short_name) like lower('%'||?||'%') or + lower(public_body_translations.request_email) like lower('%'||?||'%' )) AND (public_body_translations.locale = '#{underscore_locale}')", @query, @query, @query]).paginate :order => "public_body_translations.name", :page => @page, :per_page => 100 + end + @public_bodies_by_tag = PublicBody.find_by_tag(@query) + end + end diff --git a/app/controllers/admin_public_body_headings_controller.rb b/app/controllers/admin_public_body_headings_controller.rb index c7c80e802..e893e760d 100644 --- a/app/controllers/admin_public_body_headings_controller.rb +++ b/app/controllers/admin_public_body_headings_controller.rb @@ -10,8 +10,10 @@ class AdminPublicBodyHeadingsController < AdminController @heading = PublicBodyHeading.find(params[:id]) if @heading.update_attributes(params[:public_body_heading]) flash[:notice] = 'Category heading was successfully updated.' + redirect_to edit_admin_heading_path(@heading) + else + render :action => 'edit' end - render :action => 'edit' end end @@ -54,13 +56,6 @@ class AdminPublicBodyHeadingsController < AdminController @locale = self.locale_from_params() I18n.with_locale(@locale) do heading = PublicBodyHeading.find(params[:id]) - - if heading.public_body_categories.count > 0 - flash[:notice] = "There are categories associated with this heading, so can't destroy it" - redirect_to edit_admin_heading_url(heading) - return - end - heading.destroy flash[:notice] = "Category heading was successfully destroyed." redirect_to admin_categories_url diff --git a/app/controllers/admin_raw_email_controller.rb b/app/controllers/admin_raw_email_controller.rb new file mode 100644 index 000000000..1b3ee2871 --- /dev/null +++ b/app/controllers/admin_raw_email_controller.rb @@ -0,0 +1,45 @@ +# app/controllers/admin_raw_email_controller.rb: +# Controller for managing raw emails from the admin interface. +# +# Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved. +# Email: hello@mysociety.org; WWW: http://www.mysociety.org/ + +class AdminRawEmailController < AdminController + + def show + @raw_email = RawEmail.find(params[:id]) + respond_to do |format| + format.html do + # For the holding pen, try to guess where it should be ... + @holding_pen = false + if (@raw_email.incoming_message.info_request == InfoRequest.holding_pen_request && !@raw_email.incoming_message.empty_from_field?) + @holding_pen = true + + # 1. Use domain of email to try and guess which public body it + # is associated with, so we can display that. + email = @raw_email.incoming_message.from_email + domain = PublicBody.extract_domain_from_email(email) + + if domain.nil? + @public_bodies = [] + else + @public_bodies = PublicBody.find(:all, :order => "name", + :conditions => [ "lower(request_email) like lower('%'||?||'%')", domain ]) + end + + # 2. Match the email address in the message without matching the hash + @info_requests = InfoRequest.guess_by_incoming_email(@raw_email.incoming_message) + + # 3. Give a reason why it's in the holding pen + last_event = InfoRequestEvent.find_by_incoming_message_id(@raw_email.incoming_message.id) + @rejected_reason = last_event.params[:rejected_reason] || "unknown reason" + end + end + format.text do + response.content_type = 'message/rfc822' + render :text => @raw_email.data + end + end + end + +end diff --git a/app/controllers/admin_request_controller.rb b/app/controllers/admin_request_controller.rb index 8f023bf12..cbf7b9f4f 100644 --- a/app/controllers/admin_request_controller.rb +++ b/app/controllers/admin_request_controller.rb @@ -4,15 +4,9 @@ # Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved. # Email: hello@mysociety.org; WWW: http://www.mysociety.org/ -require 'ostruct' - class AdminRequestController < AdminController - def index - list - render :action => 'list' - end - def list + def index @query = params[:query] if @query info_requests = InfoRequest.where(["lower(title) like lower('%'||?||'%')", @query]) @@ -35,36 +29,6 @@ class AdminRequestController < AdminController :locals => vars_for_explanation) end - def resend - @outgoing_message = OutgoingMessage.find(params[:outgoing_message_id]) - @outgoing_message.prepare_message_for_resend - - mail_message = case @outgoing_message.message_type - when 'initial_request' - OutgoingMailer.initial_request( - @outgoing_message.info_request, - @outgoing_message - ).deliver - when 'followup' - OutgoingMailer.followup( - @outgoing_message.info_request, - @outgoing_message, - @outgoing_message.incoming_message_followup - ).deliver - else - raise "Message id #{id} has type '#{message_type}' which cannot be resent" - end - - @outgoing_message.record_email_delivery( - mail_message.to_addrs.join(', '), - mail_message.message_id, - 'resent' - ) - - flash[:notice] = "Outgoing message resent" - redirect_to admin_request_show_url(@outgoing_message.info_request) - end - def edit @info_request = InfoRequest.find(params[:id]) end @@ -108,13 +72,13 @@ class AdminRequestController < AdminController # expire cached files expire_for_request(@info_request) flash[:notice] = 'Request successfully updated.' - redirect_to admin_request_show_url(@info_request) + redirect_to admin_request_url(@info_request) else render :action => 'edit' end end - def fully_destroy + def destroy @info_request = InfoRequest.find(params[:id]) user = @info_request.user @@ -125,36 +89,12 @@ class AdminRequestController < AdminController expire_for_request(@info_request) email = user.try(:email) ? user.email : 'This request is external so has no associated user' flash[:notice] = "Request #{ url_title } has been completely destroyed. Email of user who made request: #{ email }" - redirect_to admin_request_list_url - end - - def edit_comment - @comment = Comment.find(params[:id]) - end - - def update_comment - @comment = Comment.find(params[:id]) - - old_body = @comment.body - old_visible = @comment.visible - @comment.visible = params[:comment][:visible] == "true" ? true : false - - if @comment.update_attributes(params[:comment]) - @comment.info_request.log_event("edit_comment", - { :comment_id => @comment.id, :editor => admin_current_user(), - :old_body => old_body, :body => @comment.body, - :old_visible => old_visible, :visible => @comment.visible, - }) - flash[:notice] = 'Comment successfully updated.' - redirect_to admin_request_show_url(@comment.info_request) - else - render :action => 'edit_comment' - end + redirect_to admin_requests_url end # change user or public body of a request magically - def move_request - info_request = InfoRequest.find(params[:info_request_id]) + def move + info_request = InfoRequest.find(params[:id]) if params[:commit] == 'Move request to user' && !params[:user_url_name].blank? old_user = info_request.user destination_user = User.find_by_url_name(params[:user_url_name]) @@ -172,7 +112,7 @@ class AdminRequestController < AdminController info_request.reindex_request_events flash[:notice] = "Message has been moved to new user" end - redirect_to admin_request_show_url(info_request) + redirect_to admin_request_url(info_request) elsif params[:commit] == 'Move request to authority' && !params[:public_body_url_name].blank? old_public_body = info_request.public_body destination_public_body = PublicBody.find_by_url_name(params[:public_body_url_name]) @@ -191,10 +131,10 @@ class AdminRequestController < AdminController flash[:notice] = "Request has been moved to new body" end - redirect_to admin_request_show_url(info_request) + redirect_to admin_request_url(info_request) else flash[:error] = "Please enter the user or authority to move the request to" - redirect_to admin_request_show_url(info_request) + redirect_to admin_request_url(info_request) end end @@ -218,7 +158,7 @@ class AdminRequestController < AdminController if !info_request.public_body.is_foi_officer?(user) flash[:notice] = user.email + " is not an email at the domain @" + info_request.public_body.foi_officer_domain_required + ", so won't be able to upload." - redirect_to admin_request_show_url(info_request) + redirect_to admin_request_url(info_request) return end @@ -231,60 +171,10 @@ class AdminRequestController < AdminController url = confirm_url(:email_token => post_redirect.email_token) flash[:notice] = ("Send \"#{name}\" <<a href=\"mailto:#{email}\">#{email}</a>> this URL: <a href=\"#{url}\">#{url}</a> - it will log them in and let them upload a response to this request.").html_safe - redirect_to admin_request_show_url(info_request) - end - - def show_raw_email - @raw_email = RawEmail.find(params[:id]) - # For the holding pen, try to guess where it should be ... - @holding_pen = false - if (@raw_email.incoming_message.info_request == InfoRequest.holding_pen_request && !@raw_email.incoming_message.empty_from_field?) - @holding_pen = true - - # 1. Use domain of email to try and guess which public body it - # is associated with, so we can display that. - email = @raw_email.incoming_message.from_email - domain = PublicBody.extract_domain_from_email(email) - - if domain.nil? - @public_bodies = [] - else - @public_bodies = PublicBody.find(:all, :order => "name", - :conditions => [ "lower(request_email) like lower('%'||?||'%')", domain ]) - end - - # 2. Match the email address in the message without matching the hash - @info_requests = InfoRequest.guess_by_incoming_email(@raw_email.incoming_message) - - # 3. Give a reason why it's in the holding pen - last_event = InfoRequestEvent.find_by_incoming_message_id(@raw_email.incoming_message.id) - @rejected_reason = last_event.params[:rejected_reason] || "unknown reason" - end - end - - def download_raw_email - @raw_email = RawEmail.find(params[:id]) - - response.content_type = 'message/rfc822' - render :text => @raw_email.data - end - - # used so due dates get fixed - def mark_event_as_clarification - info_request_event = InfoRequestEvent.find(params[:info_request_event_id]) - if info_request_event.event_type != 'response' - raise Exception("can only mark responses as requires clarification") - end - info_request_event.described_state = 'waiting_clarification' - info_request_event.calculated_state = 'waiting_clarification' - # TODO: deliberately don't update described_at so doesn't reenter search? - info_request_event.save! - - flash[:notice] = "Old response marked as having been a clarification" - redirect_to admin_request_show_url(info_request_event.info_request) + redirect_to admin_request_url(info_request) end - def hide_request + def hide ActiveRecord::Base.transaction do subject = params[:subject] explanation = params[:explanation] @@ -314,7 +204,7 @@ class AdminRequestController < AdminController end # expire cached files expire_for_request(info_request) - redirect_to admin_request_show_url(info_request) + redirect_to admin_request_url(info_request) end end diff --git a/app/controllers/admin_track_controller.rb b/app/controllers/admin_track_controller.rb index 085c9c6cc..63ee5c12e 100644 --- a/app/controllers/admin_track_controller.rb +++ b/app/controllers/admin_track_controller.rb @@ -5,7 +5,8 @@ # Email: hello@mysociety.org; WWW: http://www.mysociety.org/ class AdminTrackController < AdminController - def list + + def index @query = params[:query] if @query track_things = TrackThing.where(["lower(track_query) like lower('%'||?||'%')", @query]) @@ -13,7 +14,14 @@ class AdminTrackController < AdminController track_things = TrackThing end @admin_tracks = track_things.paginate :order => "created_at desc", :page => params[:page], :per_page => 100 - @popular = ActiveRecord::Base.connection.select_all("select count(*) as count, title, info_request_id from track_things join info_requests on info_request_id = info_requests.id where info_request_id is not null group by info_request_id, title order by count desc limit 10;") + @popular = ActiveRecord::Base.connection.select_all("select count(*) as count, title, info_request_id from track_things join info_requests on info_request_id = info_requests.id where info_request_id is not null group by info_request_id, title order by count desc limit 10;") + end + + def destroy + track_thing = TrackThing.find(params[:id].to_i) + track_thing.destroy + flash[:notice] = 'Track destroyed' + redirect_to admin_user_url(track_thing.tracking_user) end private diff --git a/app/controllers/admin_user_controller.rb b/app/controllers/admin_user_controller.rb index a6438e151..7ef461594 100644 --- a/app/controllers/admin_user_controller.rb +++ b/app/controllers/admin_user_controller.rb @@ -5,12 +5,8 @@ # Email: hello@mysociety.org; WWW: http://www.mysociety.org/ class AdminUserController < AdminController - def index - list - render :action => 'list' - end - def list + def index @query = params[:query] if @query users = User.where(["lower(name) like lower('%'||?||'%') or @@ -21,20 +17,11 @@ class AdminUserController < AdminController @admin_users = users.paginate :order => "name", :page => params[:page], :per_page => 100 end - def list_banned - @banned_users = User.paginate :order => "name", :page => params[:page], :per_page => 100, - :conditions => ["ban_text <> ''"] - end - def show # Don't use @user as that is any logged in user @admin_user = User.find(params[:id]) end - def show_bounce_message - @admin_user = User.find(params[:id]) - end - def edit @admin_user = User.find(params[:id]) end @@ -53,17 +40,19 @@ class AdminUserController < AdminController if @admin_user.valid? @admin_user.save! flash[:notice] = 'User successfully updated.' - redirect_to admin_user_show_url(@admin_user) + redirect_to admin_user_url(@admin_user) else render :action => 'edit' end end - def destroy_track - track_thing = TrackThing.find(params[:track_id].to_i) - track_thing.destroy - flash[:notice] = 'Track destroyed' - redirect_to admin_user_show_url(track_thing.tracking_user) + def banned + @banned_users = User.paginate :order => "name", :page => params[:page], :per_page => 100, + :conditions => ["ban_text <> ''"] + end + + def show_bounce_message + @admin_user = User.find(params[:id]) end def clear_bounce @@ -71,7 +60,7 @@ class AdminUserController < AdminController user.email_bounced_at = nil user.email_bounce_message = "" user.save! - redirect_to admin_user_show_url(user) + redirect_to admin_user_url(user) end def login_as @@ -87,16 +76,12 @@ class AdminUserController < AdminController def clear_profile_photo @admin_user = User.find(params[:id]) - if !request.post? - raise "Can only clear profile photo from POST request" - end - if @admin_user.profile_photo @admin_user.profile_photo.destroy end flash[:notice] = "Profile photo cleared" - redirect_to admin_user_show_url(@admin_user) + redirect_to admin_user_url(@admin_user) end def modify_comment_visibility diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 445a13d0c..dbd879a1c 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -19,6 +19,9 @@ class ApplicationController < ActionController::Base # assign our own handler method for non-local exceptions rescue_from Exception, :with => :render_exception + # Add some security-related headers (see config/initializers/secure_headers.rb) + ensure_security_headers + # Standard headers, footers and navigation for whole site layout "default" include FastGettext::Translation # make functions like _, n_, N_ etc available) @@ -29,6 +32,8 @@ class ApplicationController < ActionController::Base before_filter :check_in_post_redirect before_filter :session_remember_me before_filter :set_vary_header + before_filter :validate_session_timestamp + after_filter :persist_session_timestamp def set_vary_header response.headers['Vary'] = 'Cookie' @@ -120,6 +125,29 @@ class ApplicationController < ActionController::Base end end + # Set a TTL for non "remember me" sessions so that the cookie + # is not replayable forever + SESSION_TTL = 3.hours + def validate_session_timestamp + if session[:user_id] && session.key?(:ttl) && session[:ttl] < SESSION_TTL.ago + clear_session_credentials + redirect_to signin_path + end + end + + def persist_session_timestamp + session[:ttl] = Time.now if session[:user_id] && !session[:remember_me] + end + + # Logout form + def clear_session_credentials + session[:user_id] = nil + session[:user_circumstance] = nil + session[:remember_me] = false + session[:using_admin] = nil + session[:admin_name] = nil + end + def render_exception(exception) # In development or the admin interface let Rails handle the exception # with its stack trace templates diff --git a/app/controllers/help_controller.rb b/app/controllers/help_controller.rb index 9033198a0..93215ccad 100644 --- a/app/controllers/help_controller.rb +++ b/app/controllers/help_controller.rb @@ -11,6 +11,10 @@ class HelpController < ApplicationController before_filter :long_cache before_filter :catch_spam, :only => [:contact] + def index + redirect_to help_about_path + end + def unhappy @info_request = nil if params[:url_title] diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb index 1c01b8dc0..413b74cea 100644 --- a/app/controllers/request_controller.rb +++ b/app/controllers/request_controller.rb @@ -769,13 +769,14 @@ class RequestController < ApplicationController get_attachment_internal(false) return unless @attachment - # Prevent spam to magic request address. Note that the binary - # subsitution method used depends on the content type - @incoming_message.binary_mask_stuff!(@attachment.body, @attachment.content_type) # we don't use @attachment.content_type here, as we want same mime type when cached in cache_attachments above response.content_type = AlaveteliFileTypes.filename_to_mimetype(params[:file_name]) || 'application/octet-stream' + # Prevent spam to magic request address. Note that the binary + # subsitution method used depends on the content type + @incoming_message.apply_masks!(@attachment.body, @attachment.content_type) + render :text => @attachment.body end @@ -803,10 +804,9 @@ class RequestController < ApplicationController :body_prefix => render_to_string(:partial => "request/view_html_prefix") } ) - - @incoming_message.html_mask_stuff!(html) - response.content_type = 'text/html' + @incoming_message.apply_masks!(html, response.content_type) + render :text => html end @@ -907,10 +907,18 @@ class RequestController < ApplicationController # Type ahead search def search_typeahead - # Since acts_as_xapian doesn't support the Partial match flag, we work around it - # by making the last work a wildcard, which is quite the same - query = params[:q] - @xapian_requests = perform_search_typeahead(query, InfoRequestEvent) + # Since acts_as_xapian doesn't support the Partial match flag, we work + # around it by making the last word a wildcard, which is quite the same + @query = '' + + if params.key?(:requested_from) + @query << "requested_from:#{ params[:requested_from] } " + end + + @per_page = (params.fetch(:per_page) { 25 }).to_i + + @query << params[:q] + @xapian_requests = perform_search_typeahead(@query, InfoRequestEvent, @per_page) render :partial => "request/search_ahead" end diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index 108a6e9e5..b7c8252f5 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -253,16 +253,8 @@ class UserController < ApplicationController do_post_redirect post_redirect end - # Logout form - def _do_signout - session[:user_id] = nil - session[:user_circumstance] = nil - session[:remember_me] = false - session[:using_admin] = nil - session[:admin_name] = nil - end def signout - self._do_signout + clear_session_credentials if params[:r] redirect_to params[:r] else |