Add sub_page_setting check permissions

revert Optimize to avoid 502 errors caused by multiple queries

app/controllers/admin/seminar_signups_controller.rb

@@ -3,18 +3,26 @@ class Admin::SeminarSignupsController < OrbitAdminController
   include Admin::SeminarsHelper
   before_action ->(module_app = @app_title) { set_variables module_app }
   before_action :check_manager_for_seminar
+  skip_before_action :check_for_nil_categories
   def initialize
     super
     @app_title = "seminar"
   end
   def check_manager_for_seminar
     OrbitHelper.set_params(params,current_user)
+    OrbitHelper.set_this_module_app("seminar")
     access_level = OrbitHelper.user_access_level?
-    if (access_level.nil? || access_level == "user")
+    if access_level.nil? || access_level == "user"
       @seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
       if (@seminar.organizer_id != current_user.member_profile_id rescue true)
         render_401
       end
+    elsif access_level == "sub_manager"
+      @seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
+      approved_category_ids = current_user.approved_categories.collect{|c| c.id}
+      unless approved_category_ids.include?(@seminar.category_id) || (@seminar.organizer_id == current_user.member_profile_id rescue false)
+        render_401
+      end
     end
   end
   def edit

app/controllers/admin/seminars_controller.rb

@@ -5,10 +5,10 @@ class Admin::SeminarsController < OrbitAdminController
   include Admin::SeminarsHelper
   helper Admin::SeminarsFieldHelper
   before_action ->(module_app = @app_title) { set_variables module_app }
-  before_action :set_seminar, only: [:edit, :set_write_off, :seminar_signup, :destroy,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting]
+  before_action :set_seminar, only: [:edit, :set_write_off, :seminar_signup, :destroy,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting,:export]
   before_action :set_seminar_signup_admin_setting, only: [:seminar_signup,:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:get_reviewer_block,:get_session_block]
-  before_action :check_permission_for_seminar, only: [:seminar_signup,:get_reviewer_block,:get_session_block]
-  before_action :check_manager_for_seminar, only: [:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting]
+  before_action :check_permission_for_seminar, only: [:seminar_signup,:get_reviewer_block,:get_session_block,:export]
+  before_action :check_manager_for_seminar, only: [:seminar_signup_admin_setting,:update_seminar_signup_admin_setting,:update_seminar_review,:update_seminar_session,:reviewer_setting,:update_reviewer_setting,:template_setting,:update_template_setting,:sub_page_setting]
   def initialize
     super
     @app_title = "seminar"
@@ -39,6 +39,10 @@ class Admin::SeminarsController < OrbitAdminController
       else
         @user_authenticated_categories = ['all']
       end
+    elsif access_level == "sub_manager"
+      unless can_see_seminar_signup(@seminar)
+        render_401
+      end
     end
   end
   def template_setting
@@ -407,7 +411,7 @@ class Admin::SeminarsController < OrbitAdminController
         }
       end
     else
-      render :nothing => true
+      render_401     
     end
   end
   def copy
@@ -619,6 +623,8 @@ class Admin::SeminarsController < OrbitAdminController
     @can_edit = true
     if @access_level == "user" || @access_level.nil?
       @can_edit = false
+    elsif @access_level == "sub_manager"
+      @can_edit = can_edit_or_delete?(@seminar)
     end
     unless @can_edit
       @can_edit = (@seminar.organizer_id == current_user.member_profile_id rescue false)

app/views/admin/seminars/_index.html.erb

@@ -40,14 +40,24 @@
         </td>
         <td><%= SeminarMain.time_range(seminar.seminar_start_date, seminar.seminar_end_date) %></td>
         <td><%= SeminarMain.time_range(seminar.signup_start_date, seminar.signup_end_date) %></td>
-        <td><a href="/admin/seminars/<%=seminar.id.to_s%>/seminar_signup">
+        <td>
           <% @seminar_review = seminar.seminar_reviews.where(:reviewer_id => current_user.member_profile_id.to_s).first %>
-          <% if @seminar_review.present? && !@can_edit %>
-            <%= @seminar_review.get_all_seminar_signup_ids.count %>
+          <% if can_see_seminar_signup(seminar) %>
+            <a href="/admin/seminars/<%=seminar.id.to_s%>/seminar_signup">
+              <% if @seminar_review.present? && !@can_edit %>
+                <%= @seminar_review.get_all_seminar_signup_ids.count %>
+              <% else %>
+                <%= seminar.seminar_signups.count %>
+              <% end %>
+            </a>
           <% else %>
-            <%= seminar.seminar_signups.count %>
+            <% if @seminar_review.present? && !@can_edit %>
+              <%= @seminar_review.get_all_seminar_signup_ids.count %>
+            <% else %>
+              <%= seminar.seminar_signups.count %>
+            <% end %>
           <% end %>
-          </a></td>
+        </td>
         <td>
           <% if can_see_seminar_signup(seminar) %>
             <a href="/admin/seminars/<%=seminar.id.to_s%>/export?format=xlsx" target="_blank"><%= t('seminar.export') %></a>
@@ -62,4 +72,4 @@
   content_tag :div, class: "bottomnav clearfix" do
     content_tag :div, paginate(@seminars), class: "pagination pagination-centered"
   end
-%>
+%>

app/views/admin/seminars/export.xlsx.axlsx

@@ -2,7 +2,12 @@
 
 wb = xlsx_package.workbook
 
-wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
+illegal_chars = /[:\\\/\[\]\*\?]/
+
+sanitized_title = @seminar.title.to_s.gsub(illegal_chars, ' ').strip
+sheet_name = (sanitized_title[0..27] + '...').gsub(/\.{4,}/, '...')
+
+wb.add_worksheet(name: sheet_name) do |sheet|
 
   row = [t('seminar_signup.signup_time')]
 
@@ -26,7 +31,7 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
 
   seminar_signup_fields = @seminar.seminar_signup_fields.where(:disabled=>false).asc(:sort_number, :_id).to_a
 
-  seminar_signup_fields.each  do |rf| 
+  seminar_signup_fields.each do |rf|
     if rf.can_muti_lang_input?
       @site_in_use_locales.each do |l|
         row << rf.title + " (#{t(l.to_s)})"
@@ -35,9 +40,10 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
       row << rf.title
     end
   end
+  
   highlight_style = wb.styles.add_style(
     :bg_color => 'ffeb3b',
-    :b        => true,
+    :b => true,
     :border => { :style => :thick, :color => "000000", :edges => [:top, :left, :bottom, :right] },
     :alignment => {:horizontal => :center, :vertical => :center, :wrap_text => true}
   )
@@ -46,25 +52,36 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
   wrap_text_style = wb.styles.add_style({:alignment => {:horizontal => :center, :vertical => :center, :wrap_text => true}})
   types = [:time]
   styles = [date_time_style]
+  
+  # 優化：一次性載入所有資料，避免 N+1 查詢
+  signup_ids = @seminar_signups.map(&:id)
+  signup_values_index = {}
+  SeminarSignupValue.where(:seminar_signup_id.in => signup_ids).each do |sv|
+    key = "#{sv.seminar_signup_id}_#{sv.seminar_signup_field_id}"
+    signup_values_index[key] = sv
+  end
+  
   @seminar_signups.each_with_index do |signup, i|
     row2 = []
     row2 << signup.created_at
     row2 << "#{signup.display_serial_number}"
     row2 << "#{signup[:name]} "
     row2 << "#{signup.unit} "
-    row2 << "#{signup[:tel]} "
+    row2 << "#{signup.tel} "
     row2 << "#{signup[:phone]} "
     row2 << "#{signup[:fax]} "
     row2 << "#{signup.address} "
     row2 << "#{signup[:email]} "
     row2 << "#{signup.note} "
-    seminar_signup_fields.each  do |rf| 
+    seminar_signup_fields.each do |rf|
+      key = "#{signup.id}_#{rf.id}"
+      signup_value = signup_values_index[key]
       if rf.can_muti_lang_input?
         @site_in_use_locales.each do |l|
-          row2 << (@seminar.get_attribute_value(rf,signup.id).get_value_by_locale(l) rescue '')
+          row2 << (signup_value&.get_value_by_locale(l) rescue '')
         end
       else
-        row2 << (@seminar.get_attribute_value(rf,signup.id).get_value_by_locale(I18n.locale) rescue '')
+        row2 << (signup_value&.get_value_by_locale(I18n.locale) rescue '')
       end
     end
     if i == 0
@@ -77,4 +94,3 @@ wb.add_worksheet(name: (@seminar.title.to_s[0..27]+'...')) do |sheet|
   end
 
 end
-

config/locales/en.yml

@@ -207,7 +207,7 @@ en:
     email_address: Email address
     _password: Password
     login: Login
-    new_: 'Load abstract'
+    new_: 'UpLoad'
     load_file: load file
     enable_summary_choice: Enable summary choice
     summary_choice_type: Summary choice type

config/locales/zh_tw.yml

@@ -207,7 +207,7 @@ zh_tw:
     email_address: Email address
     _password: Password
     login: Login
-    new_: '新增(load abstract)'
+    new_: '新增(Upload)'
     load_file: load file
     enable_summary_choice: 開啟摘要選項
     summary_choice_type: 摘要選項類型