Restore frontend contribution editing, whitelist params and restrict edit page to owner

app/controllers/seminars_controller.rb

@@ -590,6 +590,7 @@ class SeminarsController < ApplicationController
     end
     update_params = seminar_signup_contribute_params.merge('seminar_submission_values'=>params['seminar_submission_values'].to_h)
     update_params.permit!
+    update_params['seminar_signup_id'] = @con.seminar_signup_id.to_s
     if update_params['seminar_submission_values'].present?
       if update_params['seminar_submission_values']['0']['value'].nil?
         flag = false
@@ -701,7 +702,8 @@ class SeminarsController < ApplicationController
       seminar = {}
       seminar_signup = {}
     end
-    con = SeminarSignupContribute.find(params[:con_no])
+    con = SeminarSignupContribute.where(id: params[:con_no]).first                                     
+    con = nil if con.nil? || @@session[:seminar_signup_id].blank? || con.seminar_signup_id.to_s != @@session[:seminar_signup_id].to_s
     {
       'con' => con,
       'seminar' => seminar,
@@ -779,7 +781,7 @@ class SeminarsController < ApplicationController
   end
 
   def seminar_signup_contribute_params
-    params.require(:seminar_signup_contribute).permit!
+    params.require(:seminar_signup_contribute).permit(:title, :file, :description, description: []) 
   end
 
   def seminar_signup_values_params

app/views/seminars/edit_file.html.erb

@@ -11,7 +11,7 @@
   @seminar_signup = data["seminar_signup"]
   @form_index = 0
 %>
-<% if !session[:seminar_signup_id].blank? %>
+<% if !session[:seminar_signup_id].blank? && @con %> 
 
 <%= form_for @con, url: edit_file_proc_seminars_path, html: {class: "content form-horizontal" , :id=>"new-seminar-signup-contribute"} do |f| %>
   <% begin %>
@@ -23,4 +23,4 @@
 
 <% else %>
 請登入
-<% end %>
+<% end %>

config/routes.rb

@@ -102,7 +102,7 @@ Rails.application.routes.draw do
         post 'con_login_proc', to: 'seminars#con_login_proc'
         post 'con_logout_proc', to: 'seminars#con_logout_proc'
         post 'add_file_proc', to: 'seminars#add_file_proc'
-        post 'edit_file_proc', to: 'seminars#edit_file_proc'
+        post 'edit_file_proc', to: 'seminars#update'
         post 'del_file', to: 'seminars#del_file'
       end
     end