Download as
Browse Code »

Commit 545921646ca8ddfe2f188540825d74a5de122726

Authored by Dhruv Kapadia
1 parent 1d31c2c6
Exists in master and in 1 other branch production-vendorized

Changes to support abtesting output. Security 

 - Users can now export the number of votes from specific vistors
   (sessions)
 - Users must now authenticate before accessing protected resources
Showing 5 changed files with 30 additions and 92 deletions   Show diff stats
app/controllers/questions_controller.rb
  Diff comments   View file @5459216
1 require 'fastercsv' 1 require 'fastercsv'
2 2
3 class QuestionsController < InheritedResources::Base 3 class QuestionsController < InheritedResources::Base
  4 + before_filter :authenticate
4 respond_to :xml, :json 5 respond_to :xml, :json
5 respond_to :csv, :only => :export #leave the option for xml export here 6 respond_to :csv, :only => :export #leave the option for xml export here
6 belongs_to :site, :optional => true 7 belongs_to :site, :optional => true
@@ -49,7 +50,6 @@ class QuestionsController &lt; InheritedResources::Base @@ -49,7 +50,6 @@ class QuestionsController &lt; InheritedResources::Base
49 end 50 end
50 51
51 def create 52 def create
52 - authenticate  
53 logger.info "all params are #{params.inspect}" 53 logger.info "all params are #{params.inspect}"
54 logger.info "vi is #{params['question']['visitor_identifier']} and local are #{params['question']['local_identifier']}." 54 logger.info "vi is #{params['question']['visitor_identifier']} and local are #{params['question']['local_identifier']}."
55 if @question = current_user.create_question(params['question']['visitor_identifier'], :name => params['question']['name'], :local_identifier => params['question']['local_identifier'], :ideas => (params['question']['ideas'].lines.to_a.delete_if {|i| i.blank?})) 55 if @question = current_user.create_question(params['question']['visitor_identifier'], :name => params['question']['name'], :local_identifier => params['question']['local_identifier'], :ideas => (params['question']['ideas'].lines.to_a.delete_if {|i| i.blank?}))
@@ -66,7 +66,6 @@ class QuestionsController &lt; InheritedResources::Base @@ -66,7 +66,6 @@ class QuestionsController &lt; InheritedResources::Base
66 66
67 67
68 def set_autoactivate_ideas_from_abroad 68 def set_autoactivate_ideas_from_abroad
69 - authenticate  
70 expire_page :action => :index 69 expire_page :action => :index
71 logger.info("INSIDE autoactivate ideas") 70 logger.info("INSIDE autoactivate ideas")
72 71
@@ -88,8 +87,6 @@ class QuestionsController &lt; InheritedResources::Base @@ -88,8 +87,6 @@ class QuestionsController &lt; InheritedResources::Base
88 87
89 end 88 end
90 def export 89 def export
91 - authenticate  
92 -  
93 type = params[:type] 90 type = params[:type]
94 91
95 if type == 'votes' 92 if type == 'votes'
@@ -104,8 +101,6 @@ class QuestionsController &lt; InheritedResources::Base @@ -104,8 +101,6 @@ class QuestionsController &lt; InheritedResources::Base
104 end 101 end
105 102
106 def num_votes_by_visitor_id 103 def num_votes_by_visitor_id
107 - authenticate  
108 -  
109 @question = current_user.questions.find(params[:id]) 104 @question = current_user.questions.find(params[:id])
110 hash = Vote.count(:conditions => "question_id = #{@question.id}", :group => "voter_id") 105 hash = Vote.count(:conditions => "question_id = #{@question.id}", :group => "voter_id")
111 visitor_id_hash = {} 106 visitor_id_hash = {}
app/controllers/visitors_controller.rb
  Diff comments   View file @5459216
1 -class VisitorsController < ApplicationController  
2 - # GET /visitors  
3 - # GET /visitors.xml  
4 - def index  
5 - @visitors = Visitor.all 1 +class VisitorsController < InheritedResources::Base
  2 + respond_to :xml, :json
  3 + before_filter :authenticate
  4 + def votes_by_session_ids
  5 + session_ids = params[:session_ids]
  6 +
  7 + visitor_ids = Visitor.find(:all, :conditions => { :identifier => session_ids})
  8 + votes_by_visitor_id = Vote.with_voter_ids(visitor_ids).count(:group => :voter_id)
  9 +
  10 + votes_by_session_id = {}
  11 +
  12 + visitor_ids.each do |e|
  13 + if votes_by_visitor_id.has_key?(e.id)
  14 + votes_by_session_id[e.identifier] = votes_by_visitor_id[e.id]
  15 + end
  16 + end
  17 +
  18 + respond_to do |format|
  19 + format.xml{ render :xml => votes_by_session_id.to_xml and return}
  20 + end
  21 + end
6 22
7 - respond_to do |format|  
8 - format.html # index.html.erb  
9 - format.xml { render :xml => @visitors }  
10 - end  
11 - end  
12 -  
13 - # GET /visitors/1  
14 - # GET /visitors/1.xml  
15 - def show  
16 - @visitor = Visitor.find(params[:id])  
17 -  
18 - respond_to do |format|  
19 - format.html # show.html.erb  
20 - format.xml { render :xml => @visitor }  
21 - end  
22 - end  
23 -  
24 - # GET /visitors/new  
25 - # GET /visitors/new.xml  
26 - def new  
27 - @visitor = Visitor.new  
28 -  
29 - respond_to do |format|  
30 - format.html # new.html.erb  
31 - format.xml { render :xml => @visitor }  
32 - end  
33 - end  
34 -  
35 - # GET /visitors/1/edit  
36 - def edit  
37 - @visitor = Visitor.find(params[:id])  
38 - end  
39 -  
40 - # POST /visitors  
41 - # POST /visitors.xml  
42 - def create  
43 - @visitor = Visitor.new(params[:visitor])  
44 -  
45 - respond_to do |format|  
46 - if @visitor.save  
47 - flash[:notice] = 'Visitor was successfully created.'  
48 - format.html { redirect_to(@visitor) }  
49 - format.xml { render :xml => @visitor, :status => :created, :location => @visitor }  
50 - else  
51 - format.html { render :action => "new" }  
52 - format.xml { render :xml => @visitor.errors, :status => :unprocessable_entity }  
53 - end  
54 - end  
55 - end  
56 -  
57 - # PUT /visitors/1  
58 - # PUT /visitors/1.xml  
59 - def update  
60 - @visitor = Visitor.find(params[:id])  
61 -  
62 - respond_to do |format|  
63 - if @visitor.update_attributes(params[:visitor])  
64 - flash[:notice] = 'Visitor was successfully updated.'  
65 - format.html { redirect_to(@visitor) }  
66 - format.xml { head :ok }  
67 - else  
68 - format.html { render :action => "edit" }  
69 - format.xml { render :xml => @visitor.errors, :status => :unprocessable_entity }  
70 - end  
71 - end  
72 - end  
73 -  
74 - # DELETE /visitors/1  
75 - # DELETE /visitors/1.xml  
76 - def destroy  
77 - @visitor = Visitor.find(params[:id])  
78 - @visitor.destroy  
79 -  
80 - respond_to do |format|  
81 - format.html { redirect_to(visitors_url) }  
82 - format.xml { head :ok }  
83 - end  
84 - end  
85 end 23 end
app/models/visitor.rb
  Diff comments   View file @5459216
@@ -7,8 +7,10 @@ class Visitor &lt; ActiveRecord::Base @@ -7,8 +7,10 @@ class Visitor &lt; ActiveRecord::Base
7 has_many :clicks 7 has_many :clicks
8 8
9 validates_presence_of :site, :on => :create, :message => "can't be blank" 9 validates_presence_of :site, :on => :create, :message => "can't be blank"
10 - validates_uniqueness_of :identifier, :on => :create, :message => "must be unique", :scope => :site_id  
11 - 10 +# validates_uniqueness_of :identifier, :on => :create, :message => "must be unique", :scope => :site_id
  11 +
  12 + named_scope :with_tracking, lambda { |*args| {:include => :votes, :conditions => { :identifier => args.first } }}
  13 +
12 def owns?(question) 14 def owns?(question)
13 questions.include? question 15 questions.include? question
14 end 16 end
app/models/vote.rb
  Diff comments   View file @5459216
@@ -8,4 +8,5 @@ class Vote &lt; ActiveRecord::Base @@ -8,4 +8,5 @@ class Vote &lt; ActiveRecord::Base
8 8
9 named_scope :recent, lambda { |*args| {:conditions => ["created_at > ?", (args.first || Date.today.beginning_of_day)]} } 9 named_scope :recent, lambda { |*args| {:conditions => ["created_at > ?", (args.first || Date.today.beginning_of_day)]} }
10 named_scope :with_question, lambda { |*args| {:conditions => {:question_id => args.first }} } 10 named_scope :with_question, lambda { |*args| {:conditions => {:question_id => args.first }} }
  11 + named_scope :with_voter_ids, lambda { |*args| {:conditions => {:voter_id=> args.first }} }
11 end 12 end
config/routes.rb
  Diff comments   View file @5459216
1 ActionController::Routing::Routes.draw do |map| 1 ActionController::Routing::Routes.draw do |map|
2 - map.resources :clicks 2 + #map.resources :clicks
  3 + map.resources :visitors, :collection => {:votes_by_session_ids => :get}
3 map.resources :questions, :member => { :num_votes_by_visitor_id => :get, :export => :post, :set_autoactivate_ideas_from_abroad => :put, :activate => :put, :suspend => :put}, :collection => {:recent_votes_by_question_id => :get} do |question| 4 map.resources :questions, :member => { :num_votes_by_visitor_id => :get, :export => :post, :set_autoactivate_ideas_from_abroad => :put, :activate => :put, :suspend => :put}, :collection => {:recent_votes_by_question_id => :get} do |question|
4 question.resources :items 5 question.resources :items
5 question.resources :prompts, :member => {:vote_left => :post, :vote_right => :post, :skip => :post, :vote => :post}, 6 question.resources :prompts, :member => {:vote_left => :post, :vote_right => :post, :skip => :post, :vote => :post},
@@ -8,6 +9,7 @@ ActionController::Routing::Routes.draw do |map| @@ -8,6 +9,7 @@ ActionController::Routing::Routes.draw do |map|
8 end 9 end
9 map.resources :algorithms 10 map.resources :algorithms
10 map.connect "/questions/:question_id/prompts/:id/vote/:index", :controller => 'prompts', :action => 'vote' 11 map.connect "/questions/:question_id/prompts/:id/vote/:index", :controller => 'prompts', :action => 'vote'
  12 +
11 13
12 14
13 15