chiu/Application_Form
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix vulnerable.

Browse Source
This commit is contained in:
bohung committed 2022-10-24 16:34:14 +08:00
1 parent 10cb149fc7
commit d86eb185dc
9 files changed
+59 -50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/controllers/admin/application_forms_controller.rb
+6 -5
View File
@@ -380,14 +380,15 @@ class Admin::ApplicationFormsController < OrbitAdminController
@categories = @module_app.categories.enabled
@filter_fields = filter_fields(@categories)
@table_fields = [:category, 'application_form.title', 'application_form.event_during', 'application_form.signup_count', 'application_form.export']
if !params[:sort].blank?
params_sort = params[:sort].to_s
if params_sort.present?
params_order = params[:order].to_s
if params[:sort] == 'event_during'
sort = {:application_form_start_date.to_sym=>params[:order]}
sort = {:application_form_start_date=>params_order}
elsif params[:sort] == 'signup_during'
sort = {:application_form_start_date.to_sym=>params[:order]}
sort = {:application_form_start_date=>params_order}
else
sort = {params[:sort].to_sym=>params[:order]}
sort = {params_sort=>params_order}
end
else
sort = {:application_form_start_date=>"desc",:created_at=>"desc"}
app/controllers/application_forms_controller.rb
+14 -11
View File
@@ -4,6 +4,7 @@ class ApplicationFormsController < ApplicationController
include MemberHelper
include ActionView::Context #vary important (only add this can access @@session from view)
include Admin::ApplicationFormsHelper
FrontendMethods = ["show_privacy", "show_data", "check_email", "check_availability", "signup_ok", "edit_file", "con_login", "con_upload", "con_logout"]
# include SimpleCaptcha::ControllerHelpers
def index
@@ -72,13 +73,14 @@ class ApplicationFormsController < ApplicationController
end
# def custom_frontend_data
# params = OrbitHelper.params
# application_form = ApplicationFormMain.find_by(:uid=>params[:uid])
# uid = params[:uid].to_s
# application_form = ApplicationFormMain.find_by(:uid=>uid)
# @application_form = application_form
# @site_in_use_locales = Site.first.in_use_locales rescue I18n.available_locales
# application_form_template_setting = application_form.application_form_template_setting
# @application_form_template_setting = application_form_template_setting
# home_page = Page.where(:parent_page_id=>application_form.id).first
# prefix_url = OrbitHelper.request.path.split("-").first + "-#{params[:uid]}"
# prefix_url = OrbitHelper.request.path.split("-").first + "-#{uid}"
# @prefix_url = prefix_url
# header_data = "<a href=\"#{prefix_url}#{home_page.url}\">Home</a> | " +
# "<a href=\"/\">Main Site</a>"
@@ -152,7 +154,7 @@ class ApplicationFormsController < ApplicationController
# if params[:method].present?
# main_content = render_other_method
# elsif params[:current_page_module] == "application_forms_home"
# application_form = ApplicationFormMain.where(uid: params[:uid]).first
# application_form = ApplicationFormMain.where(uid: uid).first
# time_now = Time.now
# data = {
# "application_form" => application_form,
@@ -168,7 +170,7 @@ class ApplicationFormsController < ApplicationController
# elsif params[:current_page_module] == "application_forms_page"
# time_now = Time.now
# params = OrbitHelper.params
# application_form = ApplicationFormMain.find_by(uid: params[:uid])
# application_form = ApplicationFormMain.find_by(uid: uid)
# if application_form.application_form_start_date <= time_now && ( application_form.application_form_end_date.nil? || application_form.application_form_end_date+1 >= time_now )
# sign_up = ('<a href="'+ prefix_url + '" target="_blank">' + t('application_form.signup') + '</a>').html_safe
# elsif application_form.registration_status.blank?
@@ -284,7 +286,7 @@ class ApplicationFormsController < ApplicationController
params = OrbitHelper.params
application_form = ApplicationFormMain.where(uid: params[:uid]).first
application_form = ApplicationFormMain.where(uid: params[:uid].to_s).first
application_form_agreement = ApplicationFormAgreement.first
@@ -301,7 +303,7 @@ class ApplicationFormsController < ApplicationController
params = OrbitHelper.params
application_form = ApplicationFormMain.find_by(uid: params[:uid])
application_form = ApplicationFormMain.find_by(uid: params[:uid].to_s)
if application_form.application_form_start_date <= time_now && ( application_form.application_form_end_date.nil? || application_form.application_form_end_date+1 >= time_now )
sign_up = ('<a href="'+ OrbitHelper.url_to_show(application_form.to_param) + '">' + t('application_form.signup') + '</a>').html_safe
@@ -347,7 +349,7 @@ class ApplicationFormsController < ApplicationController
categories = module_app.categories
application_form = ApplicationFormMain.where(uid: params[:uid]).first
application_form = ApplicationFormMain.where(uid: params[:uid].to_s).first
application_form_signup = ApplicationFormSignup.new
@@ -450,7 +452,7 @@ class ApplicationFormsController < ApplicationController
def create
form_params = params[:application_form_signup]
form_params_email = form_params[:email]
form_params_main_id = form_params[:application_form_main_id]
form_params_main_id = form_params[:application_form_main_id].to_s
@signup = nil #ApplicationFormSignup.where(email: form_params_email, application_form_main_id: form_params_main_id ).first
@application_form = ApplicationFormMain.where(id: form_params_main_id).first
@@ -741,7 +743,7 @@ class ApplicationFormsController < ApplicationController
params = OrbitHelper.params
application_form = ApplicationFormMain.find_by(uid: params[:uid])
application_form = ApplicationFormMain.find_by(uid: params[:uid].to_s)
{
'application_form' => application_form,
@@ -752,9 +754,10 @@ class ApplicationFormsController < ApplicationController
def con_login_proc
application_form = ApplicationFormMain.find_by(id: params[:application_form_signup][:application_form_main_id])
application_form_main_id = params[:application_form_signup][:application_form_main_id].to_s
application_form = ApplicationFormMain.find_by(id: application_form_main_id)
@application_form_signup = ApplicationFormSignup.where(:status=>'C', :email=> params[:user_name], :password => params[:password], :application_form_main_id => params[:application_form_signup][:application_form_main_id]).first
@application_form_signup = ApplicationFormSignup.where(:status=>'C', :email=> params[:user_name], :password => params[:password], :application_form_main_id => application_form_main_id).first
if !@application_form_signup.blank?