added new stuff for thank you and security

app/controllers/admin/ask_acknowledgements_controller.rb

@@ -7,15 +7,44 @@ class Admin::AskAcknowledgementsController < OrbitAdminController
   end
 
   def index
-    @ask_acknowledgements = AskAcknowledgement.first || AskAcknowledgement.create
-    @url = admin_ask_acknowledgement_path(@ask_acknowledgements)
-    @categories = @module_app.categories.map{|cat| [cat.title, cat.id.to_s]}
+    @ask_acknowledgements = AskAcknowledgement.where(:category_id.ne => nil).page(params[:page]).per(10)
   end
 
-  def update
-    @ask_acknowledgements = AskAcknowledgement.first
-    @ask_acknowledgements.update_attributes(params.require(:ask_acknowledgement).permit!)
+  def new
+    @ask_acknowledgement = AskAcknowledgement.new
+    cats = @module_app.categories.pluck(:id).map(&:to_s)
+    used_cats = AskAcknowledgement.pluck(:category_id).compact
+    unused_cats = cats - used_cats
+    @categories = @module_app.categories.find(unused_cats).map{|cat| [cat.title, cat.id.to_s]}
+  end
+
+  def edit
+    @ask_acknowledgement = AskAcknowledgement.find(params[:id])
+  end
+
+  def create
+    ask_ack = AskAcknowledgement.new(ack_params)
+    ask_ack.save
     redirect_to admin_ask_acknowledgements_path, notice: t('ask.save_success')
   end
 
+  def update
+    @ask_acknowledgement = AskAcknowledgement.find(params[:id])
+    @ask_acknowledgement.update_attributes(ack_params)
+    redirect_to admin_ask_acknowledgements_path, notice: t('ask.save_success')
+  end
+
+  def destroy
+    @ask_acknowledgement = AskAcknowledgement.find(params[:id])
+    @ask_acknowledgement.delete
+    redirect_to admin_ask_acknowledgements_path, notice: t('ask.delete_success')
+  end
+
+
+  private
+
+  def ack_params
+    params.require(:ask_acknowledgement).permit!
+  end
+
 end

app/controllers/admin/asks_controller.rb

@@ -221,7 +221,7 @@ class Admin::AsksController < OrbitAdminController
   def get_category_setting_field
     @default_ask_setting = AskSetting.first
     ask_setting = AskCategorySetting.find(params['id'])
-    render partial: 'category_setting_field',locals: {ask_setting: ask_setting} 
+    render partial: 'category_setting_field',locals: {ask_setting: ask_setting}
   end
   def category_print_setting_delete
     print_setting = AskCategoryPrintSetting.find(params['id'])
@@ -378,7 +378,7 @@ class Admin::AsksController < OrbitAdminController
       if !file.blank?
         if v['type']=='image'
           all_to_save += [[k,AskImage.new(file: file,ask_question_id: @ask_question.id)]]
-        else 
+        else
           all_to_save += [[k,AskFile.new(file: file,ask_question_id: @ask_question.id)]]
         end
       else
@@ -608,12 +608,40 @@ class Admin::AsksController < OrbitAdminController
     end
     render :json => {:success=>true}
   end
+
+  def download_file
+		ask_status_id = params[:ask_status_id]
+		obj = AskStatusHistory.find(ask_status_id) rescue nil
+    if obj.nil?
+      obj = AskFile.find(ask_status_id) rescue nil
+    end
+		if !obj.nil? && obj.file.present?
+			@url = obj.file.url
+			begin
+				@path = obj.file.file.file rescue ""
+				@filename = File.basename(@path)
+				@ext = @filename.split(".").last
+        if (current_site.accessibility_mode rescue false)
+          render "redirect_to_file",:layout=>false
+        else
+          user_agent = request.user_agent.downcase
+          @escaped_file_name = user_agent.match(/(msie|trident)/) ? CGI::escape(@filename) : @filename
+          send_file(@path, :type=>"application/octet-stream", :filename => @escaped_file_name, :x_sendfile=> true)
+        end
+			rescue
+				redirect_to @url
+			end
+		else
+			render :file => "#{Rails.root}/app/views/errors/404.html", :layout => false, :status => :not_found
+		end
+	end
+
   private
     def ask_setting_params(ask_setting,collection_name, except_customs=[])
       param = params.require(collection_name).except("id").permit!
       param_clone = param.clone
       param_clone['default_setting'].each { |k, v| param_clone['default_setting'][k] = (v == 'true'? true : false) if param_clone['default_setting'][k].class==String}
-      param_clone['default_setting_required'].each { |k, v| param_clone['default_setting_required'][k] = (v == 'true'? true : false) if param_clone['default_setting_required'][k].class==String} 
+      param_clone['default_setting_required'].each { |k, v| param_clone['default_setting_required'][k] = (v == 'true'? true : false) if param_clone['default_setting_required'][k].class==String}
       param_clone.delete('custom_fields')
       param_clone.delete('email_regex') unless collection_name == 'ask_setting'
       ask_setting.custom_fields_will_change!

app/controllers/asks_controller.rb

@@ -481,7 +481,7 @@ class AsksController < ApplicationController
       if @must_verify_email
         redirect_to "#{params[:referer_url]}?method=see_email"
       else
-        redirect_to "#{params[:referer_url]}?method=thank"
+        redirect_to "#{params[:referer_url]}?method=thank&category=#{params['ask_question']['category_id']}"
       end
     else
       redirect_to "#{params[:referer_url]}?method=sorry"
@@ -489,9 +489,10 @@ class AsksController < ApplicationController
   end
 
   def thank
-    acknowledgement = AskAcknowledgement.last
+    acknowledgement = AskAcknowledgement.where(:category_id => params['category']).first rescue nil
+    content = acknowledgement.nil? ? t('ask.thank_text') : acknowledgement.content
     {
-      "acknowledgement" => acknowledgement
+      "content" => content[I18n.locale]
     }
   end
 
@@ -650,6 +651,7 @@ class AsksController < ApplicationController
   def create_params
     params.require(:ask_question).permit!
   end
+
   private
     def cal_form_from_setting(ask_setting,categories,show_categories=false,filter_fields=nil)
       is_cat_record = (ask_setting.class == AskCategorySetting)