From a37d4f3cde927d6620c9e85cd2073ce26eb151b0 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Tue, 6 Feb 2018 15:46:03 +0100 Subject: [PATCH 01/59] there are always now atleast 5 rows, like in edit table in repository, so it adds empty rows if there are not atleast 5 originally --- app/helpers/protocols_io_helper.rb | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index d1107561f..45c36fe54 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -45,10 +45,15 @@ module ProtocolsIoHelper tr_regex = %r{]*>(.*?)<\/tr>}m td_regex = %r{]*>(.*?)<\/td>}m tables = {} + description_string.gsub! '', '' + description_string.gsub! '', '' table_strings = description_string.scan(table_regex) table_strings.each_with_index do |table, table_counter| tables[table_counter.to_s] = {} - tr_strings = table[0].scan(tr_regex) + tr_number = table[0].scan(tr_regex).count + diff = 5 - tr_number # always tables have atleast 5 rows + table_fixed_string = tr_number > 4 ? table[0] : table[0] + empty_tr_gen(diff) + tr_strings = table_fixed_string.scan(tr_regex) contents = {} contents['data'] = [] tr_strings.each_with_index do |tr, tr_counter| @@ -68,6 +73,15 @@ module ProtocolsIoHelper return tables, string_without_tables end + def empty_tr_gen(number) + result = '' + while number > 0 + result += '' + number -= 1 + end + result + end + def string_html_table_remove(description_string) description_string.remove!("\n", "\t", "\r", "\f") table_whole_regex = %r{(]*>.*?<\/table>)}m @@ -395,6 +409,8 @@ module ProtocolsIoHelper newj[i.to_s]['tables'], table_str = protocolsio_string_to_table_element( newj[i.to_s]['description'] ) + # Base64.decode64(newj[i.to_s]['tables'][0]['contents']) + # byebug newj[i.to_s]['description'] = table_str end # steps newj From e56c0bb1003c97013c71980ce50a1eb449cc358d Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Wed, 7 Feb 2018 10:55:44 +0100 Subject: [PATCH 02/59] Tables are now always atleast 5x5, like in scinote when creating new table --- app/helpers/protocols_io_helper.rb | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index 45c36fe54..4040ce6fb 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -52,17 +52,24 @@ module ProtocolsIoHelper tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count diff = 5 - tr_number # always tables have atleast 5 rows - table_fixed_string = tr_number > 4 ? table[0] : table[0] + empty_tr_gen(diff) + table_fixed_string = tr_number > 4 ? table[0] : table[0] + empty_tbl_gen(diff) tr_strings = table_fixed_string.scan(tr_regex) contents = {} contents['data'] = [] tr_strings.each_with_index do |tr, tr_counter| td_strings = tr[0].scan(td_regex) contents['data'][tr_counter] = [] + td_counter = td_strings.count + diff = 5 - td_counter td_strings.each do |td| td_stripped = ActionController::Base.helpers.strip_tags(td[0]) contents['data'][tr_counter].push(td_stripped) end + next if td_counter >= 5 + while diff > 0 + contents['data'][tr_counter].push(' ') + diff -= 1 + end end tables[table_counter.to_s]['contents'] = Base64.encode64( contents.to_s.sub('=>', ':') @@ -73,7 +80,7 @@ module ProtocolsIoHelper return tables, string_without_tables end - def empty_tr_gen(number) + def empty_tbl_gen(number) result = '' while number > 0 result += '' @@ -409,8 +416,6 @@ module ProtocolsIoHelper newj[i.to_s]['tables'], table_str = protocolsio_string_to_table_element( newj[i.to_s]['description'] ) - # Base64.decode64(newj[i.to_s]['tables'][0]['contents']) - # byebug newj[i.to_s]['description'] = table_str end # steps newj From a6e93b8e35e9cd7a27f1db205a8b18433be321a0 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Wed, 7 Feb 2018 13:04:02 +0100 Subject: [PATCH 03/59] Fixed hound line too long --- app/helpers/protocols_io_helper.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index 4040ce6fb..7ab71a922 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -52,8 +52,8 @@ module ProtocolsIoHelper tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count diff = 5 - tr_number # always tables have atleast 5 rows - table_fixed_string = tr_number > 4 ? table[0] : table[0] + empty_tbl_gen(diff) - tr_strings = table_fixed_string.scan(tr_regex) + table_fix_str = tr_number > 4 ? table[0] : table[0] + empty_tbl_gen(diff) + tr_strings = table_fix_str.scan(tr_regex) contents = {} contents['data'] = [] tr_strings.each_with_index do |tr, tr_counter| From 8ef6c8f91ffe7d7a69ab7271d047d674a3b5e2e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 16:14:40 +0100 Subject: [PATCH 04/59] Refactored remaining experiment level permissions (and everything below it). --- app/controllers/assets_controller.rb | 8 +- app/controllers/canvas_controller.rb | 24 +- .../my_module_comments_controller.rb | 17 +- app/controllers/my_module_tags_controller.rb | 8 +- app/controllers/my_modules_controller.rb | 41 +-- app/controllers/result_assets_controller.rb | 11 +- app/controllers/result_comments_controller.rb | 21 +- app/controllers/result_tables_controller.rb | 15 +- app/controllers/result_texts_controller.rb | 15 +- app/controllers/results_controller.rb | 6 +- app/controllers/step_comments_controller.rb | 17 +- app/controllers/steps_controller.rb | 212 +++++------ app/controllers/user_my_modules_controller.rb | 26 +- app/controllers/wopi_controller.rb | 4 +- app/helpers/permission_helper.rb | 338 ------------------ app/helpers/results_helper.rb | 16 +- app/helpers/samples_helper.rb | 8 - app/helpers/wopi_helper.rb | 11 +- app/permissions/experiment.rb | 123 +++++-- app/views/canvas/_edit.html.erb | 6 +- app/views/canvas/_tags.html.erb | 2 +- app/views/canvas/edit/_my_module.html.erb | 12 +- .../canvas/full_zoom/_my_module.html.erb | 24 +- .../canvas/medium_zoom/_my_module.html.erb | 2 +- .../my_module_comments/_comment.html.erb | 6 +- app/views/my_module_comments/_index.html.erb | 2 +- app/views/my_modules/_module_header.html.erb | 2 +- app/views/my_modules/_result.html.erb | 4 +- app/views/my_modules/_state_buttons.html.erb | 4 +- app/views/my_modules/archive/_result.html.erb | 2 +- app/views/my_modules/results.html.erb | 10 +- app/views/result_comments/_comment.html.erb | 36 +- app/views/result_comments/_index.html.erb | 2 +- app/views/results/_result_asset.html.erb | 2 +- .../results/partials/_asset_text.html.erb | 2 +- .../results/partials/_result_text.html.erb | 8 +- app/views/shared/_samples.html.erb | 4 +- .../shared/_secondary_navigation.html.erb | 4 +- app/views/step_comments/_comment.html.erb | 6 +- app/views/step_comments/_index.html.erb | 2 +- app/views/steps/_step.html.erb | 16 +- app/views/user_my_modules/_index.html.erb | 4 +- .../user_my_modules/_index_edit.html.erb | 4 +- 43 files changed, 333 insertions(+), 754 deletions(-) diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb index 99223c4b9..719bcc654 100644 --- a/app/controllers/assets_controller.rb +++ b/app/controllers/assets_controller.rb @@ -118,9 +118,7 @@ class AssetsController < ApplicationController render_403 && return unless can_read_protocol_in_module?(@protocol) || can_read_protocol_in_repository?(@protocol) elsif @assoc.class == Result - unless can_view_or_download_result_assets(@my_module) - render_403 and return - end + render_403 and return unless can_view_experiment?(@my_module.experiment) end end @@ -129,9 +127,7 @@ class AssetsController < ApplicationController render_403 && return unless can_manage_protocol_in_module?(@protocol) || can_update_protocol_in_repository?(@protocol) elsif @assoc.class == Result - unless can_edit_result_asset_in_module(@my_module) - render_403 and return - end + render_403 and return unless can_manage_module?(@my_module) end end diff --git a/app/controllers/canvas_controller.rb b/app/controllers/canvas_controller.rb index d3aa4db32..742786aaa 100644 --- a/app/controllers/canvas_controller.rb +++ b/app/controllers/canvas_controller.rb @@ -45,7 +45,7 @@ class CanvasController < ApplicationController # Make sure connections parameter is valid connections = [] - if can_edit_connections(@experiment) && update_params[:connections].present? + if update_params[:connections].present? conns = update_params[:connections].split(',') if conns.length.even? && conns.all? { |c| c.is_a? String } conns.each_slice(2).each do |c| @@ -58,7 +58,7 @@ class CanvasController < ApplicationController # Make sure positions parameter is valid positions = {} - if can_reposition_modules(@experiment) && update_params[:positions].present? + if update_params[:positions].present? poss = update_params[:positions].split(';') center = '' (poss.collect { |pos| pos.split(',') }).each_with_index do |pos, index| @@ -83,7 +83,7 @@ class CanvasController < ApplicationController # Make sure that to_add is an array of strings, # as well as that positions for newly added modules exist to_add = [] - if can_manage_experiment?(@experiment) && update_params[:add].present? && + if update_params[:add].present? && update_params['add-names'].present? ids = update_params[:add].split(',') names = update_params['add-names'].split('|') @@ -101,16 +101,16 @@ class CanvasController < ApplicationController # Make sure rename parameter is valid to_rename = {} - if can_manage_experiment?(@experiment) && update_params[:rename].present? + if update_params[:rename].present? begin to_rename = JSON.parse(update_params[:rename]) # Okay, JSON parsed! unless to_rename.is_a?(Hash) && - to_rename.keys.all? { |k| k.is_a? String } && - to_rename.values.all? { |k| k.is_a? String } && to_rename.keys.all? do |id| + id.is_a?(String) && can_manage_module?(MyModule.find_by_id(id)) - end + end && + to_rename.values.all? { |new_name| new_name.is_a? String } return render_403 end rescue @@ -125,11 +125,11 @@ class CanvasController < ApplicationController to_move = JSON.parse(update_params[:move]) # Okay, JSON parsed! unless to_move.is_a?(Hash) && - to_move.keys.all? { |k| k.is_a? String } && - to_move.values.all? { |k| k.is_a? String } && - to_rename.keys.all? do |id| + to_move.keys.all? do |id| + id.is_a?(String) && can_manage_module?(MyModule.find_by_id(id)) - end + end && + to_move.values.all? { |k| k.is_a? String } return render_403 end rescue @@ -149,7 +149,7 @@ class CanvasController < ApplicationController # Make sure that to_clone is an array of pairs, # as well as that all IDs exist to_clone = {} - if can_clone_modules(@experiment) && update_params[:cloned].present? + if update_params[:cloned].present? clones = update_params[:cloned].split(';') (clones.collect { |v| v.split(',') }).each do |val| if val.length == 2 && is_int?(val[0]) && val[1].is_a?(String) && diff --git a/app/controllers/my_module_comments_controller.rb b/app/controllers/my_module_comments_controller.rb index fdf5021ce..bd0d019ba 100644 --- a/app/controllers/my_module_comments_controller.rb +++ b/app/controllers/my_module_comments_controller.rb @@ -7,8 +7,7 @@ class MyModuleCommentsController < ApplicationController before_action :load_vars before_action :check_view_permissions, only: :index before_action :check_add_permissions, only: [:create] - before_action :check_edit_permissions, only: [:edit, :update] - before_action :check_destroy_permissions, only: [:destroy] + before_action :check_manage_permissions, only: %i(edit update destroy) def index @comments = @my_module.last_comments(@last_comment_id, @per_page) @@ -184,19 +183,13 @@ class MyModuleCommentsController < ApplicationController end def check_add_permissions - unless can_add_comment_to_module(@my_module) - render_403 - end + render_403 unless create_comment_in_module?(@my_module) end - def check_edit_permissions + def check_manage_permissions @comment = TaskComment.find_by_id(params[:id]) - render_403 unless @comment.present? && can_edit_module_comment(@comment) - end - - def check_destroy_permissions - @comment = TaskComment.find_by_id(params[:id]) - render_403 unless @comment.present? && can_delete_module_comment(@comment) + render_403 unless @comment.present? && + can_manage_comment_in_module?(@comment) end def comment_params diff --git a/app/controllers/my_module_tags_controller.rb b/app/controllers/my_module_tags_controller.rb index 2ce5a0170..f56992bff 100644 --- a/app/controllers/my_module_tags_controller.rb +++ b/app/controllers/my_module_tags_controller.rb @@ -1,7 +1,7 @@ class MyModuleTagsController < ApplicationController before_action :load_vars - before_action :check_view_permissions, only: [:index_edit, :index] - before_action :check_manage_permissions, only: %i(create destroy) + before_action :check_view_permissions, only: :index + before_action :check_manage_permissions, only: %i(create index_edit destroy) def index_edit @my_module_tags = @my_module.my_module_tags @@ -74,11 +74,11 @@ class MyModuleTagsController < ApplicationController end def check_view_permissions - render_403 unless can_read_project?(@my_module.experiment.project) + render_403 unless can_read_experiment?(@my_module.experiment) end def check_manage_permissions - render_403 unless can_create_or_manage_tags?(@my_module.experiment.project) + render_403 unless can_manage_module?(@my_module) end def init_gui diff --git a/app/controllers/my_modules_controller.rb b/app/controllers/my_modules_controller.rb index fc273fc2c..3b5ae7a6d 100644 --- a/app/controllers/my_modules_controller.rb +++ b/app/controllers/my_modules_controller.rb @@ -17,13 +17,12 @@ class MyModulesController < ApplicationController unassign_repository_records] before_action :check_manage_permissions, only: %i(update destroy description due_date) - before_action :check_view_info_permissions, only: :show before_action :check_view_permissions, only: - %i(activities activities_tab protocols results samples samples_index) - before_action :check_view_archive_permissions, only: :archive - before_action :check_assign_samples_permissions, only: :assign_samples - before_action :check_unassign_samples_permissions, only: :unassign_samples - before_action :check_complete_my_module_perimission, only: :complete_my_module + %i(show activities activities_tab protocols results samples samples_index + archive) + before_action :check_assign_samples_permissions, only: %i(assign_samples + unassign_samples) + before_action :check_complete_module_permission, only: :complete_my_module before_action :check_assign_repository_records_permissions, only: :assign_repository_records before_action :check_unassign_repository_records_permissions, @@ -480,7 +479,7 @@ class MyModulesController < ApplicationController # Complete/uncomplete task def toggle_task_state respond_to do |format| - if can_complete_module(@my_module) + if can_complete_module?(@my_module) @my_module.completed? ? @my_module.uncomplete : @my_module.complete completed = @my_module.completed? if @my_module.save @@ -602,35 +601,15 @@ class MyModulesController < ApplicationController end def check_manage_permissions - render_403 unless can_manage_module?(@my_module) - end - - def check_view_info_permissions - unless can_view_module_info(@my_module) - render_403 - end + render_403 unless can_manage_module?(@my_module) end def check_view_permissions render_403 unless can_read_experiment?(@my_module.experiment) end - def check_view_archive_permissions - unless can_view_module_archive(@my_module) - render_403 - end - end - def check_assign_samples_permissions - unless can_add_samples_to_module(@my_module) - render_403 - end - end - - def check_unassign_samples_permissions - unless can_delete_samples_from_module(@my_module) - render_403 - end + render_403 unless can_assign_sample_to_module?(@my_module) end def check_assign_repository_records_permissions @@ -641,8 +620,8 @@ class MyModulesController < ApplicationController render_403 unless can_unassign_repository_records(@my_module, @repository) end - def check_complete_my_module_perimission - render_403 unless can_complete_module(@my_module) + def check_complete_module_permission + render_403 unless can_complete_module?(@my_module) end def my_module_params diff --git a/app/controllers/result_assets_controller.rb b/app/controllers/result_assets_controller.rb index 46bd2c994..ff8c176a1 100644 --- a/app/controllers/result_assets_controller.rb +++ b/app/controllers/result_assets_controller.rb @@ -4,8 +4,7 @@ class ResultAssetsController < ApplicationController before_action :load_vars, only: [:edit, :update, :download] before_action :load_vars_nested, only: [:new, :create] - before_action :check_create_permissions, only: [:new, :create] - before_action :check_edit_permissions, only: [:edit, :update] + before_action :check_manage_permissions, only: %i(new create edit update) before_action :check_archive_permissions, only: [:update] def new @@ -191,12 +190,8 @@ class ResultAssetsController < ApplicationController render_404 unless @my_module end - def check_create_permissions - render_403 unless can_create_result_asset_in_module(@my_module) - end - - def check_edit_permissions - render_403 unless can_edit_result_asset_in_module(@my_module) + def check_manage_permissions + render_403 unless can_manage_module?(@my_module) end def check_archive_permissions diff --git a/app/controllers/result_comments_controller.rb b/app/controllers/result_comments_controller.rb index d65a03dc2..40c1a4d5f 100644 --- a/app/controllers/result_comments_controller.rb +++ b/app/controllers/result_comments_controller.rb @@ -7,8 +7,7 @@ class ResultCommentsController < ApplicationController before_action :check_view_permissions, only: [:index] before_action :check_add_permissions, only: [:create] - before_action :check_edit_permissions, only: [:edit, :update] - before_action :check_destroy_permissions, only: [:destroy] + before_action :check_manage_permissions, only: %i(edit update destroy) def index @comments = @result.last_comments(@last_comment_id, @per_page) @@ -172,27 +171,17 @@ class ResultCommentsController < ApplicationController end def check_view_permissions - unless can_view_result_comments(@my_module) - render_403 - end + render_403 unless can_read_experiment?(@my_module.experiment) end def check_add_permissions - unless can_add_result_comment_in_module(@my_module) - render_403 - end + render_403 unless create_comment_in_module?(@my_module) end - def check_edit_permissions + def check_manage_permissions @comment = ResultComment.find_by_id(params[:id]) render_403 unless @comment.present? && - can_edit_result_comment_in_module(@comment) - end - - def check_destroy_permissions - @comment = ResultComment.find_by_id(params[:id]) - render_403 unless @comment.present? && - can_delete_result_comment_in_module(@comment) + can_manage_comment_in_module?(@comment) end def comment_params diff --git a/app/controllers/result_tables_controller.rb b/app/controllers/result_tables_controller.rb index 4fefe1701..82b35dc78 100644 --- a/app/controllers/result_tables_controller.rb +++ b/app/controllers/result_tables_controller.rb @@ -5,8 +5,7 @@ class ResultTablesController < ApplicationController before_action :load_vars_nested, only: [:new, :create] before_action :convert_contents_to_utf8, only: [:create, :update] - before_action :check_create_permissions, only: [:new, :create] - before_action :check_edit_permissions, only: [:edit, :update] + before_action :check_manage_permissions, only: %i(new create edit update) before_action :check_archive_permissions, only: [:update] def new @@ -196,16 +195,8 @@ class ResultTablesController < ApplicationController end end - def check_create_permissions - unless can_create_result_table_in_module(@my_module) - render_403 - end - end - - def check_edit_permissions - unless can_edit_result_table_in_module(@my_module) - render_403 - end + def check_manage_permissions + render_403 unless can_manage_module?(@my_module) end def check_archive_permissions diff --git a/app/controllers/result_texts_controller.rb b/app/controllers/result_texts_controller.rb index a71317c8b..edea09896 100644 --- a/app/controllers/result_texts_controller.rb +++ b/app/controllers/result_texts_controller.rb @@ -9,8 +9,7 @@ class ResultTextsController < ApplicationController before_action :load_vars, only: [:edit, :update, :download] before_action :load_vars_nested, only: [:new, :create] - before_action :check_create_permissions, only: [:new, :create] - before_action :check_edit_permissions, only: [:edit, :update] + before_action :check_manage_permissions, only: %i(new create edit update) before_action :check_archive_permissions, only: [:update] def new @@ -202,16 +201,8 @@ class ResultTextsController < ApplicationController end end - def check_create_permissions - unless can_create_result_text_in_module(@my_module) - render_403 - end - end - - def check_edit_permissions - unless can_edit_result_text_in_module(@my_module) - render_403 - end + def check_manage_permissions + render_403 unless can_manage_module?(@my_module) end def check_archive_permissions diff --git a/app/controllers/results_controller.rb b/app/controllers/results_controller.rb index fbff11215..a66b01880 100644 --- a/app/controllers/results_controller.rb +++ b/app/controllers/results_controller.rb @@ -1,6 +1,6 @@ class ResultsController < ApplicationController before_action :load_vars - before_action :can_destroy_result_permission + before_action :can_destroy_permissions def destroy act_log = t('my_modules.module_archive.table_log', @@ -39,7 +39,7 @@ class ResultsController < ApplicationController @my_module = @result.my_module end - def can_destroy_result_permission - render_403 unless can_delete_module_result(@result) + def can_destroy_permissions + render_403 unless can_delete_or_archive_result?(@my_module) end end diff --git a/app/controllers/step_comments_controller.rb b/app/controllers/step_comments_controller.rb index 3f210e0bd..dd5c8584a 100644 --- a/app/controllers/step_comments_controller.rb +++ b/app/controllers/step_comments_controller.rb @@ -8,8 +8,7 @@ class StepCommentsController < ApplicationController before_action :check_view_permissions, only: [:index] before_action :check_add_permissions, only: [:create] - before_action :check_edit_permissions, only: [:edit, :update] - before_action :check_destroy_permissions, only: [:destroy] + before_action :check_manage_permissions, only: %i(edit update destroy) def index @comments = @step.last_comments(@last_comment_id, @per_page) @@ -185,21 +184,13 @@ class StepCommentsController < ApplicationController end def check_add_permissions - unless can_add_step_comment_in_protocol(@protocol) - render_403 - end + render_403 unless can_create_comment_in_module?(@protocol.my_module) end - def check_edit_permissions + def check_manage_permissions @comment = StepComment.find_by_id(params[:id]) render_403 unless @comment.present? && - can_edit_step_comment_in_protocol(@comment) - end - - def check_destroy_permissions - @comment = StepComment.find_by_id(params[:id]) - render_403 unless @comment.present? && - can_delete_step_comment_in_protocol(@comment) + can_manage_comment_in_module?(@comment) end def comment_params diff --git a/app/controllers/steps_controller.rb b/app/controllers/steps_controller.rb index 90f82e65e..2e400bc70 100644 --- a/app/controllers/steps_controller.rb +++ b/app/controllers/steps_controller.rb @@ -11,6 +11,8 @@ class StepsController < ApplicationController before_action :check_view_permissions, only: [:show] before_action :check_manage_permissions, only: %i(new create edit update destroy) + before_action :check_complete_and_checkbox_permissions, only: + %i(toggle_step_state checklistitem_state) before_action :update_checklist_item_positions, only: [:create, :update] @@ -269,53 +271,44 @@ class StepsController < ApplicationController if chkItem checked = params[:checked] == "true" protocol = chkItem.checklist.step.protocol + changed = chkItem.checked != checked + chkItem.checked = checked - authorized = ((checked and can_check_checkbox(protocol)) or (!checked and can_uncheck_checkbox(protocol))) + if chkItem.save + format.json { + render json: {}, status: :accepted + } - if authorized - changed = chkItem.checked != checked - chkItem.checked = checked + # Create activity + if changed + str = checked ? "activities.check_step_checklist_item" : + "activities.uncheck_step_checklist_item" + completed_items = chkItem.checklist.checklist_items.where(checked: true).count + all_items = chkItem.checklist.checklist_items.count + text_activity = smart_annotation_parser(chkItem.text) + .gsub(/\s+/, ' ') + message = t( + str, + user: current_user.full_name, + checkbox: text_activity, + step: chkItem.checklist.step.position + 1, + step_name: chkItem.checklist.step.name, + completed: completed_items, + all: all_items + ) - if chkItem.save - format.json { - render json: {}, status: :accepted - } - - # Create activity - if changed - str = checked ? "activities.check_step_checklist_item" : - "activities.uncheck_step_checklist_item" - completed_items = chkItem.checklist.checklist_items.where(checked: true).count - all_items = chkItem.checklist.checklist_items.count - text_activity = smart_annotation_parser(chkItem.text) - .gsub(/\s+/, ' ') - message = t( - str, - user: current_user.full_name, - checkbox: text_activity, - step: chkItem.checklist.step.position + 1, - step_name: chkItem.checklist.step.name, - completed: completed_items, - all: all_items + # This should always hold true (only in module can + # check items be checked, but still check just in case) + if protocol.in_module? + Activity.create( + user: current_user, + project: protocol.my_module.experiment.project, + experiment: protocol.my_module.experiment, + my_module: protocol.my_module, + message: message, + type_of: checked ? :check_step_checklist_item : :uncheck_step_checklist_item ) - - # This should always hold true (only in module can - # check items be checked, but still check just in case) - if protocol.in_module? - Activity.create( - user: current_user, - project: protocol.my_module.experiment.project, - experiment: protocol.my_module.experiment, - my_module: protocol.my_module, - message: message, - type_of: checked ? :check_step_checklist_item : :uncheck_step_checklist_item - ) - end end - else - format.json { - render json: {}, status: :unprocessable_entity - } end else format.json { @@ -332,92 +325,72 @@ class StepsController < ApplicationController # Complete/uncomplete step def toggle_step_state - step = Step.find_by_id(params[:id]) - respond_to do |format| - if step - completed = params[:completed] == 'true' - protocol = step.protocol + completed = params[:completed] == 'true' + protocol = step.protocol + changed = step.completed != completed + step.completed = completed - authorized = ( - (completed and can_complete_step_in_protocol(protocol)) || - (!completed and can_uncomplete_step_in_protocol(protocol)) - ) + # Update completed_on + if changed + step.completed_on = completed ? Time.current : nil + end - if authorized - changed = step.completed != completed - step.completed = completed + if step.save + if protocol.in_module? + ready_to_complete = protocol.my_module.check_completness_status + end - # Update completed_on - if changed - step.completed_on = completed ? Time.current : nil + # Create activity + if changed + completed_steps = protocol.steps.where(completed: true).count + all_steps = protocol.steps.count + str = 'activities.uncomplete_step' + str = 'activities.complete_step' if completed + + message = t( + str, + user: current_user.full_name, + step: step.position + 1, + step_name: step.name, + completed: completed_steps, + all: all_steps + ) + + # Toggling step state can only occur in + # module protocols, so my_module is always + # not nil; nonetheless, check if my_module is present + if protocol.in_module? + Activity.create( + user: current_user, + project: protocol.my_module.experiment.project, + experiment: protocol.my_module.experiment, + my_module: protocol.my_module, + message: message, + type_of: completed ? :complete_step : :uncomplete_step + ) end + end - if step.save - if protocol.in_module? - ready_to_complete = protocol.my_module.check_completness_status - end - - # Create activity - if changed - completed_steps = protocol.steps.where(completed: true).count - all_steps = protocol.steps.count - str = 'activities.uncomplete_step' - str = 'activities.complete_step' if completed - - message = t( - str, - user: current_user.full_name, - step: step.position + 1, - step_name: step.name, - completed: completed_steps, - all: all_steps - ) - - # Toggling step state can only occur in - # module protocols, so my_module is always - # not nil; nonetheless, check if my_module is present - if protocol.in_module? - Activity.create( - user: current_user, - project: protocol.my_module.experiment.project, - experiment: protocol.my_module.experiment, - my_module: protocol.my_module, - message: message, - type_of: completed ? :complete_step : :uncomplete_step - ) - end - end - - # Create localized title for complete/uncomplete button - localized_title = if !completed - t('protocols.steps.options.complete_title') - else - t('protocols.steps.options.uncomplete_title') - end - format.json do - if ready_to_complete && protocol.my_module.uncompleted? - render json: { - task_ready_to_complete: true, - new_title: localized_title - }, status: :ok - else - render json: { new_title: localized_title }, status: :ok - end - end + # Create localized title for complete/uncomplete button + localized_title = if !completed + t('protocols.steps.options.complete_title') + else + t('protocols.steps.options.uncomplete_title') + end + format.json do + if ready_to_complete && protocol.my_module.uncompleted? + render json: { + task_ready_to_complete: true, + new_title: localized_title + }, status: :ok else - format.json { - render json: {}, status: :unprocessable_entity - } + render json: { new_title: localized_title }, status: :ok end - else - format.json { - render json: {}, status: :unauthorized - } end else format.json { - render json: {}, status: :not_found + render json: {}, status: :unprocessable_entity } end end @@ -649,6 +622,11 @@ class StepsController < ApplicationController can_update_protocol_in_repository?(@protocol) end + def check_complete_and_checkbox_permissions + render_403 unless @step.present? && + can_complete_or_checkbox_step?(@protocol) + end + def step_params params.require(:step).permit( :name, diff --git a/app/controllers/user_my_modules_controller.rb b/app/controllers/user_my_modules_controller.rb index 04797669d..68db8b360 100644 --- a/app/controllers/user_my_modules_controller.rb +++ b/app/controllers/user_my_modules_controller.rb @@ -1,9 +1,7 @@ class UserMyModulesController < ApplicationController before_action :load_vars before_action :check_view_permissions, only: :index - before_action :check_edit_permissions, only: :index_edit - before_action :check_create_permissions, only: :create - before_action :check_delete_permisisons, only: :destroy + before_action :check_manage_permissions, only: %i(create index_edit destroy) def index @user_my_modules = @my_module.user_my_modules @@ -135,27 +133,11 @@ class UserMyModulesController < ApplicationController end def check_view_permissions - unless can_view_module_users(@my_module) - render_403 - end + render_403 unless can_read_experiment?(@my_module.experiment) end - def check_edit_permissions - unless can_edit_users_on_module(@my_module) - render_403 - end - end - - def check_create_permissions - unless can_add_user_to_module(@my_module) - render_403 - end - end - - def check_delete_permisisons - unless can_remove_user_from_module(@my_module) - render_403 - end + def check_manage_permissions + render_403 unless manage_users_in_module?(@my_module) end def init_gui diff --git a/app/controllers/wopi_controller.rb b/app/controllers/wopi_controller.rb index 3a8daa590..c5e8462c5 100644 --- a/app/controllers/wopi_controller.rb +++ b/app/controllers/wopi_controller.rb @@ -306,8 +306,8 @@ class WopiController < ActionController::Base end @breadcrumb_folder_url = @close_url else - @can_read = can_view_or_download_result_assets(@my_module) - @can_write = can_edit_result_asset_in_module(@my_module) + @can_read = can_view_experiment?(@my_module.experiment) + @can_write = can_manage_module?(@my_module) @close_url = results_my_module_url(@my_module, only_path: false, diff --git a/app/helpers/permission_helper.rb b/app/helpers/permission_helper.rb index 6de3be6c3..56fe4553b 100644 --- a/app/helpers/permission_helper.rb +++ b/app/helpers/permission_helper.rb @@ -40,81 +40,6 @@ module PermissionHelper end end - # ---- Almost everything is disabled for archived projects ---- - around [ - :can_view_project, - :can_restore_archived_modules, - :can_reposition_modules, - :can_edit_connections, - :can_clone_modules, - ] do |proxy, *args, &block| - if args[0] - project = args[0] - project.active? ? proxy.call(*args, &block) : false - else - false - end - end - - # ---- Almost everything is disabled for archived modules ---- - around [ - # TODO: Because module restoring is made via updating module attributes, - # (and that action checks if module is editable) this needs to be - # commented out or that functionality will not work any more. - :can_view_module_info, - :can_view_module_users, - :can_edit_users_on_module, - :can_add_user_to_module, - :can_remove_user_from_module, - :can_add_comment_to_module, - :can_view_module_archive, - :can_view_or_download_result_assets, - :can_view_result_comments, - :can_add_result_comment_in_module, - :can_create_result_text_in_module, - :can_edit_result_text_in_module, - :can_archive_result_text_in_module, - :can_create_result_table_in_module, - :can_edit_result_table_in_module, - :can_archive_result_table_in_module, - :can_create_result_asset_in_module, - :can_edit_result_asset_in_module, - :can_archive_result_asset_in_module, - :can_add_samples_to_module, - :can_delete_samples_from_module - ] do |proxy, *args, &block| - if args[0] - my_module = args[0] - if my_module.active? && - my_module.experiment.active? && - my_module.experiment.project.active? - proxy.call(*args, &block) - else - false - end - else - false - end - end - - # ---- Some things are disabled for archived experiment ---- - around [ - :can_reposition_modules, - :can_edit_connections, - :can_clone_modules, - ] do |proxy, *args, &block| - if args[0] - experiment = args[0] - if experiment.active? && - experiment.project.active? - proxy.call(*args, &block) - else - false - end - else - false - end - end end private @@ -211,166 +136,6 @@ module PermissionHelper # is_normal_user_or_admin_of_team(team) # end - # User can view project if he's assigned onto it, or if - # a project is public/visible, and user is a member of that team - def can_view_project(project) - is_admin_of_team(project.team) || - is_member_of_project(project) || - (project.visible? and is_member_of_team(project.team)) - end - - def can_restore_archived_modules(project) - is_user_or_higher_of_project(project) - end - - # ---- WORKFLOW PERMISSIONS ---- - - def can_reposition_modules(experiment) - is_user_or_higher_of_project(experiment.project) - end - - def can_edit_connections(experiment) - is_user_or_higher_of_project(experiment.project) - end - - # ---- MODULE PERMISSIONS ---- - - def can_clone_modules(experiment) - is_user_or_higher_of_project(experiment.project) - end - - def can_view_module_info(my_module) - can_view_project(my_module.experiment.project) - end - - def can_view_module_users(my_module) - can_view_project(my_module.experiment.project) - end - - def can_edit_users_on_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - - def can_add_user_to_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - - def can_remove_user_from_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - - def can_add_comment_to_module(my_module) - is_technician_or_higher_of_project(my_module.experiment.project) - end - - def can_edit_module_comment(comment) - comment.my_module.present? && - ( - comment.user == current_user || - is_owner_of_project( - comment.my_module.experiment.project - ) - ) - end - - def can_delete_module_comment(comment) - comment.my_module.present? && - ( - comment.user == current_user || - is_owner_of_project( - comment.my_module.experiment.project - ) - ) - end - - def can_view_module_archive(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_complete_module(my_module) - is_technician_or_higher_of_project(my_module.experiment.project) - end - - # ---- RESULTS PERMISSIONS ---- - - def can_view_or_download_result_assets(my_module) - is_member_of_project(my_module.experiment.project) || - can_view_project(my_module.experiment.project) - end - - def can_view_result_comments(my_module) - can_view_project(my_module.experiment.project) - end - - def can_add_result_comment_in_module(my_module) - is_technician_or_higher_of_project(my_module.experiment.project) - end - - def can_edit_result_comment_in_module(comment) - comment.result.present? && - ( - comment.user == current_user || - is_owner_of_project( - comment.result.my_module.experiment.project - ) - ) - end - - def can_delete_result_comment_in_module(comment) - comment.result.present? && - ( - comment.user == current_user || - is_owner_of_project( - comment.result.my_module.experiment.project - ) - ) - end - - def can_delete_module_result(result) - is_owner_of_project(result.my_module.experiment.project) - end - # ---- RESULT TEXT PERMISSIONS ---- - - def can_create_result_text_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_edit_result_text_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_archive_result_text_in_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - - # ---- RESULT TABLE PERMISSIONS ---- - - def can_create_result_table_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_edit_result_table_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_archive_result_table_in_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - - # ---- RESULT ASSET PERMISSIONS ---- - - def can_create_result_asset_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_edit_result_asset_in_module(my_module) - is_user_or_higher_of_project(my_module.experiment.project) - end - - def can_archive_result_asset_in_module(my_module) - is_owner_of_project(my_module.experiment.project) - end - # ---- REPORTS PERMISSIONS ---- # ---- SAMPLE PERMISSIONS ---- @@ -399,14 +164,6 @@ module PermissionHelper # is_normal_user_or_admin_of_team(team) # end - def can_add_samples_to_module(my_module) - is_technician_or_higher_of_project(my_module.experiment.project) - end - - def can_delete_samples_from_module(my_module) - is_technician_or_higher_of_project(my_module.experiment.project) - end - # ---- SAMPLE TYPES PERMISSIONS ---- # def can_create_sample_type_in_team(team) @@ -482,101 +239,6 @@ module PermissionHelper # protocol.in_repository_archived? # end - # ---- STEPS PERMISSIONS ---- - - def can_add_step_comment_in_protocol(protocol) - if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.project.active? && - my_module.experiment.active? && - is_technician_or_higher_of_project(my_module.experiment.project) - else - # In repository, user cannot complete steps - false - end - end - - def can_edit_step_comment_in_protocol(comment) - return false if comment.step.blank? - - protocol = comment.step.protocol - if protocol.in_module? - comment.user == current_user || - is_owner_of_project( - protocol.my_module.experiment.project - ) - else - false - end - end - - def can_delete_step_comment_in_protocol(comment) - return false if comment.step.blank? - - protocol = comment.step.protocol - if protocol.in_module? - comment.user == current_user || - is_owner_of_project( - protocol.my_module.experiment.project - ) - else - false - end - end - - def can_complete_step_in_protocol(protocol) - if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.project.active? && - my_module.experiment.active? && - is_technician_or_higher_of_project(my_module.experiment.project) - else - # In repository, user cannot complete steps - false - end - end - - def can_uncomplete_step_in_protocol(protocol) - if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.project.active? && - my_module.experiment.active? && - is_user_or_higher_of_project(my_module.experiment.project) - else - # In repository, user cannot complete steps - false - end - end - - def can_check_checkbox(protocol) - if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.project.active? && - my_module.experiment.active? && - is_technician_or_higher_of_project(my_module.experiment.project) - else - # In repository, user cannot check checkboxes - false - end - end - - def can_uncheck_checkbox(protocol) - if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.project.active? && - my_module.experiment.active? && - is_user_or_higher_of_project(my_module.experiment.project) - else - # In repository, user cannot check checkboxes - false - end - end - # ---- REPOSITORIES PERMISSIONS ---- # def can_view_team_repositories(team) diff --git a/app/helpers/results_helper.rb b/app/helpers/results_helper.rb index 939c71586..94afa84c9 100644 --- a/app/helpers/results_helper.rb +++ b/app/helpers/results_helper.rb @@ -20,23 +20,11 @@ module ResultsHelper end def can_edit_result(result) - if result.is_text - can_edit_result_text_in_module(result.my_module) - elsif result.is_table - can_edit_result_table_in_module(result.my_module) - elsif result.is_asset - can_edit_result_asset_in_module(result.my_module) - end + can_manage_module?(result.my_module) end def can_archive_result(result) - if result.is_text - can_archive_result_text_in_module(result.my_module) - elsif result.is_table - can_archive_result_table_in_module(result.my_module) - elsif result.is_asset - can_archive_result_asset_in_module(result.my_module) - end + can_delete_or_archive_result?(result.my_module) end def result_unlocked?(result) diff --git a/app/helpers/samples_helper.rb b/app/helpers/samples_helper.rb index 3fd6608c3..9ecf6591f 100644 --- a/app/helpers/samples_helper.rb +++ b/app/helpers/samples_helper.rb @@ -1,12 +1,4 @@ module SamplesHelper - def can_add_samples - module_page? && can_add_samples_to_module(@my_module) - end - - def can_remove_samples - module_page? && can_delete_samples_from_module(@my_module) - end - def can_add_sample_related_things_to_team can_manage_sample_columns?(@team) end diff --git a/app/helpers/wopi_helper.rb b/app/helpers/wopi_helper.rb index 097a5cbc1..33a9f4257 100644 --- a/app/helpers/wopi_helper.rb +++ b/app/helpers/wopi_helper.rb @@ -1,6 +1,7 @@ module WopiHelper def wopi_result_view_file_button(result) - if result.asset.can_perform_action('view') + if can_read_experiment?(result.my_module.experiment) && + result.asset.can_perform_action('view') link_to view_asset_url(id: result.asset), class: 'btn btn-default btn-sm', target: '_blank', @@ -13,7 +14,7 @@ module WopiHelper end def wopi_result_edit_file_button(result) - if can_edit_result_asset_in_module(result.my_module) && + if can_manage_module?(result.my_module) && result.asset.can_perform_action('edit') link_to edit_asset_url(id: result.asset), class: 'btn btn-default btn-sm', @@ -27,7 +28,8 @@ module WopiHelper end def wopi_asset_view_button(asset) - if asset.can_perform_action('view') + if can_read_experiment?(result.my_module.experiment) && + asset.can_perform_action('view') link_to view_asset_url(id: asset), class: 'btn btn-default btn-sm', target: '_blank', @@ -39,7 +41,8 @@ module WopiHelper end def wopi_asset_edit_button(asset) - if asset.can_perform_action('edit') + if can_manage_module?(result.my_module) && + asset.can_perform_action('edit') link_to edit_asset_url(id: asset), class: 'btn btn-default btn-sm', target: '_blank', diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index 316e17221..4fbcc4e0c 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -1,13 +1,16 @@ Canaid::Permissions.register_for(Experiment) do - # experiment: read - # canvas/workflow: read + # experiment: read (read archive) + # canvas: read + # module: read (read users, read comments, read archive) + # result: read (read comments) can :read_experiment do |user, experiment| can_read_project?(user, experiment.project) end - # experiment: create/update/delete - # canvas/workflow: edit - # module: create + # experiment: create, update, delete + # canvas: edit + # module: create, clone, reposition, create/update/delete connection, + # assign/reassign/unassign tags can :manage_experiment do |user, experiment| user.is_user_or_higher_of_project?(experiment.project) end @@ -46,17 +49,53 @@ Canaid::Permissions.register_for(Experiment) do end Canaid::Permissions.register_for(MyModule) do + # module: edit, archive, move + # result: create, update + can :manage_module do |user, my_module| + can_manage_experiment?(user, my_module.experiment) + end + # module: restore can :restore_module do |user, my_module| can_manage_experiment?(user, my_module.experiment) && my_module.archived? end - # module: edit, archive, move - can :manage_module do |user, my_module| - can_manage_experiment?(user, my_module.experiment) + # module: assign/reassign/unassign users + can :manage_users_in_module do |user, my_module| + user.is_owner_of_project?(my_module.experiment.project) end - %i(manage_module).each do |perm| + # result: delete, archive + can :delete_or_archive_result do |user, my_module| + user.is_owner_of_project?(my_module.experiment.project) + end + + # module: assign/unassign sample + can :assign_sample_to_module do |user, my_module| + module_page? && + user.is_technician_or_higher_of_project?(my_module.experiment.project) + end + + # module: complete/uncomplete + can :complete_module do |user, my_module| + user.is_technician_or_higher_of_project?(my_module.experiment.project) + end + + # TODO: When rebasing on top of refactored projects permissions, just call + # can_create_comment_in_project?(user, my_module.experiment.project) instead + # module: create comment + # result: create comment + # step: create comment + can :create_comment_in_module do |user, my_module| + user.is_technician_or_higher_of_project?(my_module.experiment.project) + end + + %i(manage_module + manage_users_in_module + delete_or_archive_result + assign_sample_to_module + complete_module + create_comment_in_module).each do |perm| can perm do |_, my_module| my_module.experiment.project.active? end @@ -68,11 +107,7 @@ Canaid::Permissions.register_for(Protocol) do # step: read, read comments, read assets, download assets can :read_protocol_in_module do |user, protocol| if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.active? && - my_module.experiment.project.active? && - can_read_experiment?(user, my_module.experiment) + can_read_experiment?(user, protocol.my_module.experiment) else false end @@ -83,21 +118,67 @@ Canaid::Permissions.register_for(Protocol) do # step: create/update/delete, reorder can :manage_protocol_in_module do |user, protocol| if protocol.in_module? - my_module = protocol.my_module - my_module.active? && - my_module.experiment.active? && - my_module.experiment.project.active? && - can_manage_module?(user, my_module) + can_manage_module?(user, protocol.my_module) else false end end + # step: complete/uncomplete + can :complete_or_checkbox_step do |user, protocol| + if protocol.in_module? + can_complete_module?(user, protocol.my_module) + else + # In repository, user cannot complete steps + false + end + end + %i(read_protocol_in_module - manage_protocol_in_module) + manage_protocol_in_module + complete_or_checkbox_step) .each do |perm| can perm do |_, protocol| - protocol.my_module.experiment.project.active? + my_module = protocol.my_module + my_module.active? && + my_module.experiment.active? && + my_module.experiment.project.active? + end + end +end + +Canaid::Permissions.register_for(Comment) do + # module: update/delete comment + # result: update/delete comment + # step: update/delete comment + can :manage_comment_in_module do |user, comment| + project = case comment.is_a? + when TaskComment + comment.my_module.experiment.project + when ResultComment + comment.result.my_module.experiment.project + when StepComment + comment.step.protocol.my_module.experiment.project + end + project.present? && + # TODO: When rebasing on top of refactored projects permissions, just call + # can_manage_comment_in_project?(user, project) instead + (user.is_owner_of_project(project) || comment.user == current_user) + end + + %i(comment).each do |perm| + can perm do |_, comment| + my_module = case comment.is_a? + when TaskComment + comment.my_module + when ResultComment + comment.result.my_module + when StepComment + comment.step.protocol.my_module + end + my_module.active? && + my_module.experiment.active? && + my_module.experiment.project.active? end end end diff --git a/app/views/canvas/_edit.html.erb b/app/views/canvas/_edit.html.erb index 3f8b63ecb..c17831623 100644 --- a/app/views/canvas/_edit.html.erb +++ b/app/views/canvas/_edit.html.erb @@ -1,11 +1,11 @@
" data-can-edit-modules="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" - data-can-clone-modules="<%= can_clone_modules(@experiment) ? "yes" : "no" %>" + data-can-clone-modules="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" data-can-move-modules="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" data-can-delete-modules="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" - data-can-reposition-modules="<%= can_reposition_modules(@experiment) ? "yes" : "no" %>" - data-can-edit-connections="<%= can_edit_connections(@experiment) ? "yes" : "no" %>" + data-can-reposition-modules="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" + data-can-edit-connections="<%= can_manage_experiment?(@experiment) ? "yes" : "no" %>" data-unsaved-work-text="<%=t "experiments.canvas.edit.unsaved_work" %>" > <%= bootstrap_form_tag url: canvas_experiment_url, method: "post" do |f| %> diff --git a/app/views/canvas/_tags.html.erb b/app/views/canvas/_tags.html.erb index 61a88a0df..9149e54c8 100644 --- a/app/views/canvas/_tags.html.erb +++ b/app/views/canvas/_tags.html.erb @@ -13,7 +13,7 @@ <%= my_module.tags.count %> <% else %> - "> + "> + <% end %> diff --git a/app/views/canvas/edit/_my_module.html.erb b/app/views/canvas/edit/_my_module.html.erb index 1e2b28012..9a4adefa5 100644 --- a/app/views/canvas/edit/_my_module.html.erb +++ b/app/views/canvas/edit/_my_module.html.erb @@ -21,7 +21,7 @@ <%=t "experiments.canvas.edit.edit_module" %> <% end %> - <% if can_clone_modules(my_module.experiment) %> + <% if can_manage_experiment?(my_module.experiment) %>
  • <%=t "experiments.canvas.edit.clone_module" %>
    • @@ -33,16 +33,18 @@
  • <%=t "experiments.canvas.edit.move_module" %>
    • -
  • > + <% if my_module.my_module_group && my_module.my_module_group.my_modules.all? { |my_module| can_manage_module?(my_module) } %> +
  • <%=t "experiments.canvas.edit.move_module_group" %>
    • + <% end %> + <% if can_manage_module?(my_module) %>
  • <%=t "experiments.canvas.edit.delete_module" %>
    • <% end %> <% if my_module.my_module_group && my_module.my_module_group.my_modules.all? { |my_module| can_manage_module?(my_module) } %> -
  • > +
  • <%=t "experiments.canvas.edit.delete_module_group" %>
    • <% end %> @@ -51,7 +53,7 @@
    - <% if can_edit_connections(my_module.experiment) %> + <% if can_manage_experiment?(my_module.experiment) %>
    <%=t "experiments.canvas.edit.drag_connections" %>
    diff --git a/app/views/canvas/full_zoom/_my_module.html.erb b/app/views/canvas/full_zoom/_my_module.html.erb index 57311e6f4..8d04617cf 100644 --- a/app/views/canvas/full_zoom/_my_module.html.erb +++ b/app/views/canvas/full_zoom/_my_module.html.erb @@ -12,15 +12,13 @@ data-module-tags-url="<%= my_module_my_module_tags_url(my_module, format: :json) %>" data-module-users-tab-url="<%= my_module_user_my_modules_url(my_module_id: my_module.id, format: :json) %>"> - <% if can_create_or_manage_tags?(my_module.experiment.project) %> + <% if can_manage_module?(my_module) %> - <% else %> - - <% end %> - <%= render partial: "canvas/tags.html.erb", locals: { my_module: my_module } %> - <% if can_create_or_manage_tags?(my_module.experiment.project) %> + <%= render partial: "canvas/tags.html.erb", locals: { my_module: my_module } %> <% else %> + + <%= render partial: "canvas/tags.html.erb", locals: { my_module: my_module } %> <% end %> @@ -42,14 +40,12 @@
    -<% if can_add_comment_to_module(@my_module) %> +<% if create_comment_in_module?(@my_module) %>
    - <% if can_create_result_text_in_module(@my_module) or - can_create_result_table_in_module(@my_module) or - can_create_result_asset_in_module(@my_module) %> + <% if can_manage_module?(@my_module) %> - <% end %> - <% if can_create_result_text_in_module(@my_module) %> - <% end %> - <% if can_create_result_table_in_module(@my_module) %> - <% end %> - <% if can_create_result_asset_in_module(@my_module) %> <%=t "my_modules.results.comment_title", user: comment.user.full_name, time: l(comment.created_at, format: :time) %> - <% if can_edit_result_comment_in_module(comment) || can_delete_result_comment_in_module(comment) %> + <% if can_manage_comment_in_module?(comment) %>
    <% end %> diff --git a/app/views/result_comments/_index.html.erb b/app/views/result_comments/_index.html.erb index 12cd6d445..ec554d46e 100644 --- a/app/views/result_comments/_index.html.erb +++ b/app/views/result_comments/_index.html.erb @@ -17,7 +17,7 @@ <%= render 'result_comments/list.html.erb', comments: @comments %> <% end %> -<% if can_add_result_comment_in_module(@my_module) then %> +<% if create_comment_in_module?(@my_module) then %>
    • diff --git a/app/views/results/_result_asset.html.erb b/app/views/results/_result_asset.html.erb index b38409131..bda38be36 100644 --- a/app/views/results/_result_asset.html.erb +++ b/app/views/results/_result_asset.html.erb @@ -1,4 +1,4 @@ -<% if can_view_or_download_result_assets(result.my_module) %> +<% if can_view_experiment?(result.my_module.experiment) %> <% if result.asset.file.processing? %> diff --git a/app/views/search/results/partials/_asset_text.html.erb b/app/views/search/results/partials/_asset_text.html.erb index eaf004510..1e81800a3 100644 --- a/app/views/search/results/partials/_asset_text.html.erb +++ b/app/views/search/results/partials/_asset_text.html.erb @@ -5,7 +5,7 @@ <% protocol = asset.step.protocol %> <% if can_read_protocol_in_module?(protocol) || can_read_protocol_in_repository?(protocol) || - (asset.result && can_view_or_download_result_assets(asset.result.my_module) %> + (asset.result && can_read_experiment?(protocol.my_module.experiment)) %> <%= text %> diff --git a/app/views/search/results/partials/_result_text.html.erb b/app/views/search/results/partials/_result_text.html.erb index 17e8b11f1..a86fb5081 100644 --- a/app/views/search/results/partials/_result_text.html.erb +++ b/app/views/search/results/partials/_result_text.html.erb @@ -4,16 +4,16 @@ <% if result.archived? %> <%=t "search.index.archived" %> - <% if can_view_module_archive(result.my_module) %> + <% if can_read_experiment?(result.my_module.experiment) %> <% if target == :comment %> <%= route_to_other_team archive_my_module_path(result.my_module, ctarget: "result-panel-#{result.id}"), result.my_module.experiment.project.team, text %> <% else %> - <%= route_to_other_team archive_my_module_path(result.my_module), - result.my_module.experiment.project.team, - text %> + <%= route_to_other_team archive_my_module_path(result.my_module), + result.my_module.experiment.project.team, + text %> <% end %> <% else %> <%= text %> diff --git a/app/views/shared/_samples.html.erb b/app/views/shared/_samples.html.erb index 8abde3c26..4f1edf62e 100644 --- a/app/views/shared/_samples.html.erb +++ b/app/views/shared/_samples.html.erb @@ -109,15 +109,13 @@ <% end %> - <% if can_add_samples %> + <% if can_assign_sample_to_module?(@my_module) %> <%= submit_tag MyModulesController::ASSIGN_SAMPLES, :class => "hidden" %> - <% end %> - <% if can_remove_samples %>
      • - <% end %> - <% if can_read_experiment?(@experiment) %>
    • "> "> @@ -204,7 +202,7 @@
    <% end %> - <% if can_view_module_archive(@my_module) then %> + <% if can_read_experiment?(@my_module.experiment) then %>
  • "> diff --git a/app/views/step_comments/_comment.html.erb b/app/views/step_comments/_comment.html.erb index 0f8c6ecf3..8c9de185b 100644 --- a/app/views/step_comments/_comment.html.erb +++ b/app/views/step_comments/_comment.html.erb @@ -2,7 +2,7 @@ <%=t "protocols.steps.comment_title", user: comment.user.full_name, time: l(comment.created_at, format: :time) %> - <% if can_edit_step_comment_in_protocol(comment) || can_delete_step_comment_in_protocol(comment) %> + <% if can_manage_comment_in_module?(comment) %>
    <% end %> diff --git a/app/views/step_comments/_index.html.erb b/app/views/step_comments/_index.html.erb index ac7827d0e..6142db39b 100644 --- a/app/views/step_comments/_index.html.erb +++ b/app/views/step_comments/_index.html.erb @@ -17,7 +17,7 @@ <%= render 'step_comments/list.html.erb', comments: @comments %> <% end %> -<% if can_add_step_comment_in_protocol(@protocol) %> +<% if can_create_comment_in_module?(@protocol.my_module) %>
    • diff --git a/app/views/steps/_step.html.erb b/app/views/steps/_step.html.erb index 0b2e34d3e..b5e60ab0a 100644 --- a/app/views/steps/_step.html.erb +++ b/app/views/steps/_step.html.erb @@ -161,19 +161,19 @@ <% end %> - <% if @protocol.in_module? %> - <% if !step.completed? and can_complete_step_in_protocol(@protocol) %> -
      - -
      - <% elsif step.completed? and can_uncomplete_step_in_protocol(@protocol) %> + <% if can_complete_or_checkbox_step?(@protocol) %> + <% if step.completed? %>
      + <% else %> +
      + +
      <% end %> <% end %> diff --git a/app/views/user_my_modules/_index.html.erb b/app/views/user_my_modules/_index.html.erb index 2617d4805..0a14261e8 100644 --- a/app/views/user_my_modules/_index.html.erb +++ b/app/views/user_my_modules/_index.html.erb @@ -25,9 +25,9 @@ <% end %> <% end %>
    -<% if can_edit_users_on_module(@my_module) then %> +<% if manage_users_in_module?(@my_module) then %>

    <%= link_to t('experiments.canvas.popups.manage_users'), my_module_users_edit_path(@my_module, format: :json), remote: true, class: "manage-users-link" %>

    -<% end %> \ No newline at end of file +<% end %> diff --git a/app/views/user_my_modules/_index_edit.html.erb b/app/views/user_my_modules/_index_edit.html.erb index 6aa5c6991..a5d6ee637 100644 --- a/app/views/user_my_modules/_index_edit.html.erb +++ b/app/views/user_my_modules/_index_edit.html.erb @@ -19,7 +19,7 @@ - <% if can_remove_user_from_module(@my_module) then %> + <% if manage_users_in_module?(@my_module) then %>
    <%= link_to my_module_user_my_module_path(@my_module, umm, format: :json), method: :delete, remote: true, class: 'btn btn-link remove-user-link' do %> @@ -32,7 +32,7 @@ <% end %> <% end %> -<% if can_add_user_to_module(@my_module) and @unassigned_users.count > 0 %> +<% if manage_users_in_module?(@my_module) and @unassigned_users.count > 0 %>
  • From d7108f5a35bb47de19896ab2028eda79a3904b14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 17:05:43 +0100 Subject: [PATCH 05/59] Fixed Hound warnings. --- app/controllers/steps_controller.rb | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/app/controllers/steps_controller.rb b/app/controllers/steps_controller.rb index 2e400bc70..34a25e433 100644 --- a/app/controllers/steps_controller.rb +++ b/app/controllers/steps_controller.rb @@ -275,15 +275,17 @@ class StepsController < ApplicationController chkItem.checked = checked if chkItem.save - format.json { - render json: {}, status: :accepted - } + format.json { render json: {}, status: :accepted } # Create activity if changed - str = checked ? "activities.check_step_checklist_item" : - "activities.uncheck_step_checklist_item" - completed_items = chkItem.checklist.checklist_items.where(checked: true).count + str = if checked + 'activities.check_step_checklist_item' + else + 'activities.uncheck_step_checklist_item' + end + completed_items = chkItem.checklist.checklist_items + .where(checked: true).count all_items = chkItem.checklist.checklist_items.count text_activity = smart_annotation_parser(chkItem.text) .gsub(/\s+/, ' ') @@ -306,7 +308,11 @@ class StepsController < ApplicationController experiment: protocol.my_module.experiment, my_module: protocol.my_module, message: message, - type_of: checked ? :check_step_checklist_item : :uncheck_step_checklist_item + type_of: if checked + :check_step_checklist_item + else + :uncheck_step_checklist_item + end ) end end From d55734e5012a19c71fc3b1d95281229415cd8225 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 18:02:04 +0100 Subject: [PATCH 06/59] Added additional permission checks for moving tasks. Added forgotten enclosing tag in a view. --- app/controllers/canvas_controller.rb | 5 ++++- app/views/canvas/edit/_my_module.html.erb | 1 + app/views/canvas/edit/modal/_move_module.html.erb | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/app/controllers/canvas_controller.rb b/app/controllers/canvas_controller.rb index 742786aaa..dc34ba77d 100644 --- a/app/controllers/canvas_controller.rb +++ b/app/controllers/canvas_controller.rb @@ -129,7 +129,10 @@ class CanvasController < ApplicationController id.is_a?(String) && can_manage_module?(MyModule.find_by_id(id)) end && - to_move.values.all? { |k| k.is_a? String } + to_move.values.all? do |exp_id| + exp_id.is_a?(String) && + can_manage_experiment?(Experiment.find_by_id(exp_id)) + end return render_403 end rescue diff --git a/app/views/canvas/edit/_my_module.html.erb b/app/views/canvas/edit/_my_module.html.erb index 9a4adefa5..6a8631ee8 100644 --- a/app/views/canvas/edit/_my_module.html.erb +++ b/app/views/canvas/edit/_my_module.html.erb @@ -33,6 +33,7 @@
  • <%=t "experiments.canvas.edit.move_module" %>
    • + <% end %> <% if my_module.my_module_group && my_module.my_module_group.my_modules.all? { |my_module| can_manage_module?(my_module) } %>
  • <%=t "experiments.canvas.edit.move_module_group" %> diff --git a/app/views/canvas/edit/modal/_move_module.html.erb b/app/views/canvas/edit/modal/_move_module.html.erb index d617b82c0..1ef56df02 100644 --- a/app/views/canvas/edit/modal/_move_module.html.erb +++ b/app/views/canvas/edit/modal/_move_module.html.erb @@ -10,7 +10,7 @@ <% if experiments.count > 1 %> <%= bootstrap_form_tag do |f| %> <%= f.select :experiment_id, experiments - .select { |e| e != @experiment } + .select { |e| e != @experiment && can_manage_experiment?(e) } .collect { |e| [ e.name, e.id ] }, {}, {class: "form-control selectpicker", "data-role" => "clear"} %> <% end %> From 68206cb591e4aa8eab6fa852fe861b27417ebb65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 18:18:41 +0100 Subject: [PATCH 07/59] Added missing checks for whether task/experiment/project is active for experiment level permissions. Minor code refactoring and restyling. --- app/permissions/experiment.rb | 7 +++++-- .../canvas/edit/modal/_move_module.html.erb | 16 ++++++++-------- config/locales/en.yml | 4 ++-- 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index 4fbcc4e0c..4cf808cc0 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -43,7 +43,8 @@ Canaid::Permissions.register_for(Experiment) do move_experiment) .each do |perm| can perm do |_, experiment| - experiment.project.active? + experiment.active? && + experiment.project.active? end end end @@ -97,7 +98,9 @@ Canaid::Permissions.register_for(MyModule) do complete_module create_comment_in_module).each do |perm| can perm do |_, my_module| - my_module.experiment.project.active? + my_module.active? && + my_module.experiment.active? && + my_module.experiment.project.active? end end end diff --git a/app/views/canvas/edit/modal/_move_module.html.erb b/app/views/canvas/edit/modal/_move_module.html.erb index 1ef56df02..491ba9ff5 100644 --- a/app/views/canvas/edit/modal/_move_module.html.erb +++ b/app/views/canvas/edit/modal/_move_module.html.erb @@ -6,7 +6,7 @@
    - <% experiments = @experiment.project.experiments.is_archived(false) %> + <% experiments = @experiment.project.experiments %> <% if experiments.count > 1 %> <%= bootstrap_form_tag do |f| %> <%= f.select :experiment_id, experiments @@ -14,13 +14,13 @@ .collect { |e| [ e.name, e.id ] }, {}, {class: "form-control selectpicker", "data-role" => "clear"} %> <% end %> - <% else %> -
    - - <%= t("experiments.canvas.edit.modal_move_module.no_experiments") %> - -
    - <% end %> + <% else %> +
    + + <%= t("experiments.canvas.edit.modal_move_module.no_experiments") %> + +
    + <% end %>
    <% if experiments.count > 1 %> diff --git a/config/locales/en.yml b/config/locales/en.yml index 6db4618fa..5ff556bd8 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -1907,9 +1907,9 @@ en: leave_flash: "Successfuly left team %{team}." teams: create_permission_error: "You don't have permission to create team." - update_permission_error: "You don't have permission to edit team." + update_permission_error: "You don't have permission to edit this team." user: current_password_invalid: "incorrect password" password_confirmation_not_match: "doesn't match" invite_users: - permission_error: "You don't have permission to invite additional users to team. Contact its administrator/s." + permission_error: "You don't have permission to invite additional users to this team. Contact its administrator/s." From 946f5161715206088b9f1d52d4a17458524d1522 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 18:50:23 +0100 Subject: [PATCH 08/59] Fixed permission error when moving a freshly cloned task. --- app/controllers/canvas_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/canvas_controller.rb b/app/controllers/canvas_controller.rb index dc34ba77d..c055f9199 100644 --- a/app/controllers/canvas_controller.rb +++ b/app/controllers/canvas_controller.rb @@ -127,7 +127,7 @@ class CanvasController < ApplicationController unless to_move.is_a?(Hash) && to_move.keys.all? do |id| id.is_a?(String) && - can_manage_module?(MyModule.find_by_id(id)) + (!is_int?(id) || can_manage_module?(MyModule.find_by_id(id))) end && to_move.values.all? do |exp_id| exp_id.is_a?(String) && From 4c87fb4a5504fb0dac1d6c5ce864851922f7a451 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 19:05:09 +0100 Subject: [PATCH 09/59] Fixed permission error when restoring task. --- app/controllers/my_modules_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/my_modules_controller.rb b/app/controllers/my_modules_controller.rb index 3b5ae7a6d..d1fb7695c 100644 --- a/app/controllers/my_modules_controller.rb +++ b/app/controllers/my_modules_controller.rb @@ -600,8 +600,10 @@ class MyModulesController < ApplicationController render_404 unless @repository && can_read_team?(@repository.team) end + # NOTE: 'update' action also contains restore (and archive) logic def check_manage_permissions - render_403 unless can_manage_module?(@my_module) + render_403 unless can_manage_module?(@my_module) || + can_restore_module?(@my_module) end def check_view_permissions From f21c794a95122ee3612b9225a4e1587e7e7cbc44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Fri, 9 Feb 2018 19:20:06 +0100 Subject: [PATCH 10/59] Fixed permission error when accessing samples page. --- app/permissions/experiment.rb | 4 ++-- app/views/shared/_samples.html.erb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index 4cf808cc0..7f06eac77 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -72,9 +72,9 @@ Canaid::Permissions.register_for(MyModule) do end # module: assign/unassign sample + # NOTE: Use 'module_page? &&' before calling this permission! can :assign_sample_to_module do |user, my_module| - module_page? && - user.is_technician_or_higher_of_project?(my_module.experiment.project) + user.is_technician_or_higher_of_project?(my_module.experiment.project) end # module: complete/uncomplete diff --git a/app/views/shared/_samples.html.erb b/app/views/shared/_samples.html.erb index 4f1edf62e..c2888eae8 100644 --- a/app/views/shared/_samples.html.erb +++ b/app/views/shared/_samples.html.erb @@ -109,7 +109,7 @@ <% end %> - <% if can_assign_sample_to_module?(@my_module) %> + <% if module_page? && can_assign_sample_to_module?(@my_module) %>
    • - <% if can_delete_or_archive_result?(result.my_module) %> + <% if can_manage_result?(result.my_module) %>
  • <%= link_to t('my_modules.module_archive.option_delete'), result_path(action: :delete, id: result.id), diff --git a/app/views/my_modules/protocols/_protocol_status_bar_buttons.html.erb b/app/views/my_modules/protocols/_protocol_status_bar_buttons.html.erb index 22d24c32a..6adf6e836 100644 --- a/app/views/my_modules/protocols/_protocol_status_bar_buttons.html.erb +++ b/app/views/my_modules/protocols/_protocol_status_bar_buttons.html.erb @@ -40,7 +40,7 @@ -<% if can_create_comment_in_module?(@my_module) then %> +<% if can_create_comments_in_module?(@my_module) then %> <% if can_manage_project?(@project) %> -

    -

    - <%= link_to t("projects.index.manage_users"), project_users_edit_path(@project, format: :json), class: "manage-users-link", remote: true %> -

    - <% end %> +

    +

    + <%= link_to t("projects.index.manage_users"), project_users_edit_path(@project, format: :json), class: "manage-users-link", remote: true %> +

    +<% end %> From 29aea1ebd2c80ec70bfe3003bb7f15474512a971 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Wed, 21 Feb 2018 16:17:53 +0100 Subject: [PATCH 23/59] refactored according to PR --- app/controllers/protocols_controller.rb | 27 +++++++++++---------- app/helpers/protocols_io_helper.rb | 32 +++---------------------- 2 files changed, 18 insertions(+), 41 deletions(-) diff --git a/app/controllers/protocols_controller.rb b/app/controllers/protocols_controller.rb index 7656b126f..aabc9f6b5 100644 --- a/app/controllers/protocols_controller.rb +++ b/app/controllers/protocols_controller.rb @@ -640,10 +640,11 @@ class ProtocolsController < ApplicationController return 0 # return 0 stops the rest of the controller code from executing end @json_object = JSON.parse(json_file_contents) - @json_object['steps'] = step_hash_not_null(@json_object['steps']) - @json_object['steps'] = protocols_io_guid_reorder_step_json( - @json_object['steps'] - ) + unless step_hash_null?(@json_object['steps']) + @json_object['steps'] = protocols_io_guid_reorder_step_json( + @json_object['steps'] + ) + end @protocol = Protocol.new respond_to do |format| @@ -658,24 +659,26 @@ class ProtocolsController < ApplicationController @db_json = {} @toolong = false @db_json['name'] = pio_eval_title_len( - sanitize_input(params['protocol']['name']) + sanitize_input(not_null(params['protocol']['name'])) ) # since scinote only has description field, and protocols.io has many others # ,here i am putting everything important from protocols.io into description @db_json['authors'] = pio_eval_title_len( - sanitize_input(params['protocol']['authors']) + sanitize_input(not_null(params['protocol']['authors'])) ) @db_json['created_at'] = pio_eval_title_len( - sanitize_input(params['protocol']['created_at']) + sanitize_input(not_null(params['protocol']['created_at'])) ) @db_json['updated_at'] = pio_eval_title_len( - sanitize_input(params['protocol']['last_modified']) + sanitize_input(not_null(params['protocol']['last_modified'])) ) @db_json['steps'] = {} - @json_object['steps'] = step_hash_not_null(@json_object['steps']) - @db_json['steps'] = protocols_io_fill_step( - @json_object, @db_json['steps'] - ) + + unless step_hash_null?(@json_object['steps']) + @db_json['steps'] = protocols_io_fill_step( + @json_object, @db_json['steps'] + ) + end protocol = nil respond_to do |format| transaction_error = false diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index 132377e94..ae2a45499 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -150,7 +150,7 @@ module ProtocolsIoHelper Nokogiri::HTML::DocumentFragment.parse(text).to_html end - def step_hash_not_null(step_json) + def step_hash_null?(step_json) is_null_check = false if step_json.blank? is_null_check = true @@ -166,38 +166,12 @@ module ProtocolsIoHelper is_null_check = false end if is_null_check - return generate_null_step_skeleton + return true else - step_json + return false end end - # Creates dummy info for when empty steps json is sent, or - # hash structure is modified - def generate_null_step_skeleton - json_string = [ - { - 'guid' => '0', - 'previous_guid' => nil, - 'components' => - [ - { - 'component_type_id' => '1', - 'name' => 'Description', - 'data' => '', - 'data_id' => nil - }, - { - 'component_type_id' => '6', - 'name' => 'Section', - 'data' => 'Step', - 'data_id' => '0' - } - ] - } - ] - json_string - end # Images are allowed in: # Step: description, expected result # Protocol description : description before_start warning From 1904099954093596fb261f6f0b5fe86be0a9d4c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Wed, 21 Feb 2018 20:22:13 +0100 Subject: [PATCH 24/59] Put permissions helper methods inside utility module. --- app/permissions/experiment.rb | 19 ++----------------- app/utilities/permissions_util.rb | 20 ++++++++++++++++++++ 2 files changed, 22 insertions(+), 17 deletions(-) create mode 100644 app/utilities/permissions_util.rb diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index 383423b45..320da0d2f 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -175,7 +175,7 @@ Canaid::Permissions.register_for(Comment) do # result: update/delete comment # step: update/delete comment can :manage_comment_in_module do |user, comment| - my_module = get_comment_module(comment) + my_module = ::PermissionsUtil.get_comment_module(comment) project = my_module.experiment.project # Same check as in `can_manage_comment_in_project?` project.present? && @@ -186,25 +186,10 @@ Canaid::Permissions.register_for(Comment) do # permissions %i(manage_comment_in_module).each do |perm| can perm do |_, comment| - my_module = get_comment_module(comment) + my_module = ::PermissionsUtil.get_comment_module(comment) my_module.active? && my_module.experiment.active? && my_module.experiment.project.active? end end end - -private - -def get_comment_module(comment) - comment = comment.becomes(comment.type.constantize) - my_module = case comment - when TaskComment - comment.my_module - when ResultComment - comment.result.my_module - when StepComment - comment.step.protocol.my_module - end - my_module -end diff --git a/app/utilities/permissions_util.rb b/app/utilities/permissions_util.rb new file mode 100644 index 000000000..456e6eb1a --- /dev/null +++ b/app/utilities/permissions_util.rb @@ -0,0 +1,20 @@ +module PermissionsUtil + def self.get_comment_module(comment) + comment = comment.becomes(comment.type.constantize) + my_module = case comment + when TaskComment + comment.my_module + when ResultComment + comment.result.my_module + when StepComment + comment.step.protocol.my_module + end + my_module + end + + def self.reference_project(obj) + return obj.experiment.project if obj.is_a? MyModule + return obj.project if obj.is_a? Experiment + obj + end +end From ff9dff5c1080caab79b077dfd0390a53abdc35ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Thu, 22 Feb 2018 13:51:22 +0100 Subject: [PATCH 25/59] Fixed reports permissions check calls. Fixed Hound warnings. --- app/controllers/reports_controller.rb | 40 ++++++++++++--------------- app/controllers/steps_controller.rb | 2 +- 2 files changed, 19 insertions(+), 23 deletions(-) diff --git a/app/controllers/reports_controller.rb b/app/controllers/reports_controller.rb index 0238ac5a8..83cd7850e 100644 --- a/app/controllers/reports_controller.rb +++ b/app/controllers/reports_controller.rb @@ -30,23 +30,24 @@ class ReportsController < ApplicationController ] before_action :check_view_permissions, only: :index - before_action :check_create_permissions, only: [ - :new, - :create, - :generate, - :save_modal, - :project_contents_modal, - :experiment_contents_modal, - :module_contents_modal, - :step_contents_modal, - :result_contents_modal, - :project_contents, - :module_contents, - :step_contents, - :result_contents - ] - before_action :check_manage_permissions, only: %i(edit update - destroy) + before_action :check_manage_permissions, only: %i( + new + create + edit + update + destroy + generate + save_modal + project_contents_modal + experiment_contents_modal + module_contents_modal + step_contents_modal + result_contents_modal + project_contents + module_contents + step_contents + result_contents + ) layout 'fluid' @@ -449,13 +450,8 @@ class ReportsController < ApplicationController render_403 unless can_read_project?(@project) end - def check_create_permissions - render_403 unless can_manage_reports?(@project) - end - def check_manage_permissions render_403 unless can_manage_reports?(@project) - render_404 unless params.include? :report_ids end def report_params diff --git a/app/controllers/steps_controller.rb b/app/controllers/steps_controller.rb index b57bdfa1d..85fa0daa3 100644 --- a/app/controllers/steps_controller.rb +++ b/app/controllers/steps_controller.rb @@ -267,7 +267,7 @@ class StepsController < ApplicationController # Responds to checkbox toggling in steps view def checklistitem_state respond_to do |format| - checked = params[:checked] == "true" + checked = params[:checked] == 'true' changed = @chk_item.checked != checked @chk_item.checked = checked From 96a6779d55ce78b91a85f85e5cd2076a69a8930c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Thu, 22 Feb 2018 14:08:12 +0100 Subject: [PATCH 26/59] Fixed misspelled permission call. --- app/controllers/steps_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/steps_controller.rb b/app/controllers/steps_controller.rb index 90f82e65e..bef026835 100644 --- a/app/controllers/steps_controller.rb +++ b/app/controllers/steps_controller.rb @@ -640,7 +640,7 @@ class StepsController < ApplicationController end def check_view_permissions - render_403 unless can_read_protocol_in_module(@protocol) || + render_403 unless can_read_protocol_in_module?(@protocol) || can_read_protocol_in_repository?(@protocol) end From 48bdd841634874cb0ffea7681391a766b8ad97ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Thu, 22 Feb 2018 14:18:53 +0100 Subject: [PATCH 27/59] Updated file upload text, to notify user of another approach to uploading files. --- config/locales/en.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/locales/en.yml b/config/locales/en.yml index 6db4618fa..3477c732a 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -1781,7 +1781,7 @@ en: edit: "sciNote | %{file_name} | Edit" view: "sciNote | %{file_name} | View" drag_n_drop: - label_html: 'Drag & drop files here or ' + label_html: 'Drag & drop files here, CTRL+V (for images from clipboard) or ' browse_label: 'Browse to add' drop_label: 'Drop to add to Step' file_label: 'File' From aa933ad1f42ded0b96f1b0794174150604ffe4bc Mon Sep 17 00:00:00 2001 From: Oleksii Kriuchykhin Date: Mon, 26 Feb 2018 14:23:02 +0100 Subject: [PATCH 28/59] Add extendable file types mappings for icons [PIP-46] --- app/helpers/file_icons_helper.rb | 5 +++++ app/views/results/_result_asset.html.erb | 7 +++++-- app/views/steps/_step.html.erb | 7 +++++-- app/views/steps/_wopi_controlls.html.erb | 7 +++++-- config/initializers/extends.rb | 4 ++++ 5 files changed, 24 insertions(+), 6 deletions(-) diff --git a/app/helpers/file_icons_helper.rb b/app/helpers/file_icons_helper.rb index e12c51fd7..877248220 100644 --- a/app/helpers/file_icons_helper.rb +++ b/app/helpers/file_icons_helper.rb @@ -15,6 +15,11 @@ module FileIconsHelper image_link = 'office/PowerPoint-pptx_20x20x32.png' end + # Now check for custom mappings or possible overrides + if Extends::FILE_ICON_MAPPINGS[file_ext] + image_link = Extends::FILE_ICON_MAPPINGS[file_ext] + end + if image_link image_tag image_link else diff --git a/app/views/results/_result_asset.html.erb b/app/views/results/_result_asset.html.erb index b38409131..8dfcb55a6 100644 --- a/app/views/results/_result_asset.html.erb +++ b/app/views/results/_result_asset.html.erb @@ -20,8 +20,11 @@ <% if wopi_file?(result.asset) %> <%= wopi_asset_file_name(result.asset) %> <% else %> -

    <%= truncate(result.asset.file_file_name, - length: Constants::FILENAME_TRUNCATION_LENGTH) %>

    +

    + <%= file_extension_icon(result.asset) %> + <%= truncate(result.asset.file_file_name, + length: Constants::FILENAME_TRUNCATION_LENGTH) %> +

    <% end %> <% end %> <%= wopi_result_view_file_button(result) %> diff --git a/app/views/steps/_step.html.erb b/app/views/steps/_step.html.erb index fc57e310b..e3fc6cbab 100644 --- a/app/views/steps/_step.html.erb +++ b/app/views/steps/_step.html.erb @@ -123,8 +123,11 @@ <% else %> <%= image_tag asset.url(:medium) if asset.is_image? %> <% end %> -

    <%= truncate(asset.file_file_name, - length: Constants::FILENAME_TRUNCATION_LENGTH) %>

    +

    + <%= file_extension_icon(asset) %> + <%= truncate(asset.file_file_name, + length: Constants::FILENAME_TRUNCATION_LENGTH) %> +

    <% end %>
    • <% end %> diff --git a/app/views/steps/_wopi_controlls.html.erb b/app/views/steps/_wopi_controlls.html.erb index 73b330355..472f1a824 100644 --- a/app/views/steps/_wopi_controlls.html.erb +++ b/app/views/steps/_wopi_controlls.html.erb @@ -7,8 +7,11 @@ <% if wopi_file?(asset) %> <%= wopi_asset_file_name(asset) %> <% else %> -

    <%= truncate(asset.file_file_name, - length: Constants::FILENAME_TRUNCATION_LENGTH) %>

    +

    + <%= file_extension_icon(asset) %> + <%= truncate(asset.file_file_name, + length: Constants::FILENAME_TRUNCATION_LENGTH) %> +

    <% end %> <% end %> <%= wopi_asset_view_button(asset) %> diff --git a/config/initializers/extends.rb b/config/initializers/extends.rb index 27495f574..cebef7c6e 100644 --- a/config/initializers/extends.rb +++ b/config/initializers/extends.rb @@ -50,4 +50,8 @@ class Extends API_PLUGABLE_AUTH_METHODS = [] OMNIAUTH_PROVIDERS = [] + + # Hash used for mapping file extensions to custom icons, + # 'extension' => 'path_to_the_icon' + FILE_ICON_MAPPINGS = {} end From 08439e7f5814c043957d24f05560d62e671878d3 Mon Sep 17 00:00:00 2001 From: mlorb Date: Mon, 26 Feb 2018 11:05:05 +0100 Subject: [PATCH 29/59] sign up with linkedIn account --- Gemfile | 1 + .../linkedin/Sign-in-Small---Active.png | Bin 0 -> 2469 bytes .../linkedin/Sign-in-Small---Default.png | Bin 0 -> 2468 bytes .../images/linkedin/Sign-in-Small---Hover.png | Bin 0 -> 2475 bytes .../users/omniauth_callbacks_controller.rb | 66 ++++++++++++++++++ .../users/registrations_controller.rb | 55 +++++++++++++-- app/models/user.rb | 8 +++ .../registrations/new_with_provider.html.erb | 37 ++++++++++ app/views/users/shared/_links.html.erb | 15 +++- config/environments/development.rb | 3 + config/environments/production.rb | 3 + config/initializers/devise.rb | 2 + config/initializers/extends.rb | 5 +- config/initializers/paperclip.rb | 2 + config/locales/en.yml | 8 +++ config/routes.rb | 2 + lib/tasks/data.rake | 6 ++ 17 files changed, 206 insertions(+), 7 deletions(-) create mode 100644 app/assets/images/linkedin/Sign-in-Small---Active.png create mode 100644 app/assets/images/linkedin/Sign-in-Small---Default.png create mode 100644 app/assets/images/linkedin/Sign-in-Small---Hover.png create mode 100644 app/views/users/registrations/new_with_provider.html.erb diff --git a/Gemfile b/Gemfile index ff658fde3..1bea45cc0 100644 --- a/Gemfile +++ b/Gemfile @@ -17,6 +17,7 @@ gem 'font-awesome-rails', '~> 4.7.0.2' gem 'recaptcha', require: 'recaptcha/rails' gem 'sanitize', '~> 4.4' gem 'omniauth' +gem 'omniauth-linkedin-oauth2' # Gems for API implementation gem 'jwt', '~> 1.5' diff --git a/app/assets/images/linkedin/Sign-in-Small---Active.png b/app/assets/images/linkedin/Sign-in-Small---Active.png new file mode 100644 index 0000000000000000000000000000000000000000..dea692fd904f6a52798d58f55523437638994e33 GIT binary patch literal 2469 zcmaJ@c{o&iA0J%XNH1+fn8v=0F=H8X9+GA(Q^q=#B{I#NVJ5SfImIB`Ra#ysC*FSNar2`5hOM>1oQ@}bYXZiXa|GI z=rSq3kT2N{pmEve)K!dmB%3E;!(es}kvuBxFbE+IfgwzeJ#wbH9*JPm?UDPf$rfZD z0SsljM)5(PD0d1i>M#vYM>_04*hK;o0X7Ix5s~aLjsS?XM}E}>B==P}8j1J{fezav z|4z!6?1><7`5?mD+!{r*z+w-3b;r3G|Au?x~rjh0D%uuAugZ7<%X?w(KD0_aRs4V9)dtX z7?G(oCTG<){z@Q|0TM?5Q8_e_M6^drB+QviI^c-I*jQq1Z1H#}3k=4|%Fz;ob+T~A z*jf>=Rzw_bjZ5Uxj<7)vw8o|X!1#l{iH6+9{>^e0ruuP+hHC9r1KBG%C(AWadTn#QTdg z%XLquHH-x9L}dR0QBF6|aNWv&aiu6#+@Bma7?F|MudU_1bbw`AV{A+YgoJW~ZjG9& zFV%PND9#g)t6eQw{Nxhfvq3aIsb8BEioes^5)gIkjY-{|*}`pcae_Dg z7vJi&6pul56Wl;2pr>I}e|n3DMx&lI??JQ{(6h@RvuL5SHe-F-$%^@NS=l~)#N@Pq z#nTHoc$s1DHM$dgZ{7T+F|;uLq1@8k+~`Ti3SsB5m|kiBcEfT#s#W{sbO;L!z!~P} znO>bLX6UfSj*|3(pO^X@voSnVC4vAT?#E zWJ^cXjsy%LQ5cj^hbnuVY;i0`Ph_7x#9u#Gt}>lmqWdsS;ng@iO)vG;xN-LF>p9Vg zXUCq?qPc@{Im>y`Q~8ZPsQ$n`I&Ep9tr2;nvHg1Ocf%HRt`oM~1PKaL#yJD+GkYfe zU*|0P81-&*52^m5uU6W`>PFq_;g_Dd&<1^ATxwtPimfXdQTH2h=D$oyzJBf2ou?es zSPbh?1NP>NT8i(>HX5&^DyQ|Gb;!S!i$DLWWTrH}`Gi!wuX@Qx+g+dbF2zMmdcJkf zzndk$H0XU`658>4rn9+opzN1iq$Hh!pW})mx~D_@Zcfe_ zM};axcOCDlEe{eS?H+YBI=;L1Q=R{N+ZOw%^QVx6l!5)Iq;pc#`~G)|&yOvZk0%by zjQ)kdLr2OB6G%zWc75YiWgF|~#CG2i;U$E)ZLdfFo1WZCNK_(4$TPLg6lb`xW*bxa zfS@jqVQ{}gQz^ug+@|Dal3}Pwf08TS-|}{ zW{Y%{W1+`U?crlrZY*6`P;9UI&`dlB%v0()E2+0W1!hQ8s` z;X9k()6P@&c;pvdAGhS!&o(*_UgZ@l=$Eh4S2+}4n!lrWvRcE(bI=tnaw~fNUN_hC zU~B+sT=lY9dqy9lce23}_99dM4{4d!iO2@zM3Z*MPeYq~U-$T|{5F=6opZp8UF`yQ z6rIfiauw(Osj`;Z7Q4@ih|w-;PRh9E{M||=`=Wzq&nw6)C@Y-lRK0v-mQbI6Z|pHg z48N^Z_Ve<3ahv_l*f)9iYHPyPCfr?3RT5=SBx_h_{fFLycsl%T77}`ifO+52P zx;Zldg~arP6cf|)iCw@a%7epdK*|J88tiS|rp?=#tl9sjsAS(k%KX!KTKexd1ep!% zlb*6_B$q&U3jY+Y3Q!y_(o13Rl}OVh!l7mjDKU#mIC4{%)kv?hdqz7@6h zJ@{N}Oze_A`3m1RqB zcis3Dl!A;H2cYMhw>O5HnQ4MHuZ|tK`(V#Q zTkZ<3f*&iLr4Xd>A)FIoT_0dI7X*iY1j}S^<4cS7)$dj}5~PvIi)At6Hyl(tW;X^Z zuCF$4Y9#A!bt#k|S~9pFp$b1T;C~PNVx?z-@PZdrv_3|6d$<{9hS2#7Ep}Qs`JWt(Ik^){cLgW@2P#@C^8f$< literal 0 HcmV?d00001 diff --git a/app/assets/images/linkedin/Sign-in-Small---Default.png b/app/assets/images/linkedin/Sign-in-Small---Default.png new file mode 100644 index 0000000000000000000000000000000000000000..f8129afe228724278d7a687894cee5b2bd328080 GIT binary patch literal 2468 zcmaJ@dpwhU8y}vON)kDxn!CkHvja=ptgMYp8^c6LX1m9*L)$PFO35Lwl0%OQIpk1@ zC#h7Dybh&urj#T?Y7X^Ah@PqRynnpC_vdrpzu)!yT;K2Y{ax4hk2{*-uuXlT!9oZG zqE5A=I4joEig)<}RmHd9>CGXu-i&yMtkC6cMdy3SL z2>cM`PG>;LLNN%%nqd)a6b22o#F?S77C1C|0~CWonWE^U-XMsAo zG89f{v3Y{oc-?mZosOppBvO`u4N@sYKtW-~<8km93J!xd$8N>pY*1*ljRnaZjj=)5 zqBmKPF%}d{%Q-AX$PVCx0_hx<^ADE%TkNbC_##DR3Ml3Uf*f11kPrQSXFTusS`?%D zot7V1&hNF5ev3sa#2{xU`(KluJ5tzZcKge>ir|;?L4m^VVui0u=5cEv5LI0&g~XI~ zeAwm3aCOz*2Zie%-41sotpbjCdTNleJYnk*#eeyqZ8WYs#KEG8w$l~Nuxs2$)EWzW zZ?DIz=V9@ibGDk$oLZb=Z!?ZtEe~F};L+iRndA?3rIw}RFW<9ZxUR?D=Ox3hrmmEY z-Mm*a)_uF-5^XBM@O{1dLkPNd@t5#>_kO_nYmtpnJsx^zY@9j-GQ<3yBc`akl zVUyI`Ew<~r3@@6t-wx1y$50V^2bX-QfEsHaHXjNYV5CO%MqHd6@Xf9?0z$^!)C=kh zFQ~kIa;SQm!TPMC#4PGH!cX@t?if9^*d{jMZGA$>OWup-@zI@&e28iP{x~pdb+xQ3 zzl1Meqcu@9uSDMRm|W1gG5U|};q^KtPD<&K3#}$}a~oUV6Q$QOQ<{d-txM~)CJ3v8 z+|KF@KJi9e_$*tN@oLEGDy1t|LOXFvdvlx)5&y7H -gbmi0JsIl?al{$UZj;|}7 z;CxrVaZi!ctNTVdsb2@nxap+)rXbzsGxfBL-Vr4euG(AsuDzM~RFYO)}l}8*3 z%ex!>Dh->mZvonw>}{E_$Xmap&`~4jtZ92*W@&=S)W=Z zC6X11J^AvZwf@WGlJ&bwHFWUB+3~LC0h#gkD+teZVog<4Ab&Nul!%nycBJ8Pq z@1zj_98YGq?x;EXt*>fQaz{ly^~xkVv(09zAmR+|6SD)PBU-=sGJu^)UZk|UU^GW+ zKK#)>%<0~yJ9e#`+zNwS9&kK5ZlcoSPE_58nU~|e#0Htlz2PyOvSjO(dplcl{HS`Nb0rQ3WpY=2t&Hb$@8QMerBwYGehjbz#g3s?b z@2J`HawkHHg>RA4(MzoLKY zsT27H);`t1?s9*1Q)#S)anh9p*bZ34XmH;o*-D94yKF_M=|y+agVY++=M}!5m+RF? zg4K>Hgq6nzKMZ!~(H4K|^MfZX6O+P-0gbeEI)@G>%C9aBG;O|+#fa1G-ZC;HyRyJ6 zQ8mmBTZ|}L0qZz_P?9Fuxav*tR-AcS)b)2R+ot_=<2UQTtRGb#@!NJdVq|$^Tx~T+ z6ANv<6J5cTf3?wOXF5B8>z$O>sru+PUeviU`IW(}>CXjf%rina@1Vwebr;FDJ#D)j zx+GC)U|`S)fqEu$_cRQh9t8ZZS~g|g+VJooGGaI*#`n-*UYHy>EjGEC_2n9QNreO7 z#dnjI@7ozM*XngQ_o`h05E-d9pL($gxYTN*r40^7FhJS(27mRqFBWqZBv{yGSgBvU5 z9EIBH|CuMApAeFHJZW%*K;7|ag7I3klbAbyL&MCa9h0{`+9Zz*=F5*7a0`-@0~_3o zinFS?Z0MUU9sI7i(tDrr?H;n3)4kN|uGxs}^4MUP(r3rRH2z5Rt4JLLQVtq*DI}$L|4rlDf2f83cVQ)60jk+I@7T< z@rPZfR8NKPt}3IcC5LE^!einWa`2~~xw`wc-uMQOWoUz|>%7;MyX-4`85$nM9|iQ9 zF^dK&6Gg_F%mrin`RyKEh_jmZ~?sja4JMAX213U$SX^u@;YW7TUG(yGB6IZ7MsQv$fwHBx4O|xPO~}J#=*2Wf=Y2q z&hqPaeEf`?PxV;2YqQb8gZcHri9;Rn5eTSr4E)@S5Ogcg^P4E4V) aL_t)e)~>2Oj9WkZ-$b=>pj_SR8U8n+!X0S< literal 0 HcmV?d00001 diff --git a/app/assets/images/linkedin/Sign-in-Small---Hover.png b/app/assets/images/linkedin/Sign-in-Small---Hover.png new file mode 100644 index 0000000000000000000000000000000000000000..643236eec81478a14fca58654bbcd7d8c206e9e8 GIT binary patch literal 2475 zcmaJ@c|4SB8=iy^b-rvRWen-0n1wNBGL7Xm*=8`-R5Z=J7|hbls~HL%%h7VmHj{%Q zW#7WFBpvjfq*R=;9a~7{NZC4}@b!&OI^Q4ly}#f4KF|I9uIsw*=f1B$-ZL)L{VGaY zN-!8q#oi8}N!MiQtF9m~{g$@XPD+<8kgYf5#`TAUbUp~PVsejyaC2%m z6ih_?U6eP)1#ZLTgK(@d)`)?^py4>YF&b-%N2B+^F(|YN5{*J)@J47f!4yY8o54Rn z2x&Gx)1N>C$e(jbBO)RYf_MZZQYaJ}3r&o<`~V~xkH;fX7$gQ`Bt;kr!Z;9JWW*8Z ztttSZfWc?+AQqPcUs0qV<%U8;gtXGXufXPgk>vbCi9n$c>^TC6&S8M|01+XTFlMos1S=fc%mia*ipSfc&}dszD-$%v z7DYyzo7!MZ0UU0X3vd~sY>)%3a+&{dvESsbc!AB6W(Gh$>o~|H^SNyJr#ll^U#SHH z;4x?uEbvXe&s^qLYWd8y{U#SFEe5$V+5egJ>XFnwE88!=l?Gp&4|1e-=SzKU$e2}z z!Q{8w16J;$zSlk~P9EUqNGtfCGJHj2-(zl;k%*|@WFP2M0+f<8YJZ7o?dyac2Oam6 zP;eP_bs%2wO6iwsNjgFI!DgF_00B7TA||C?J+wtroUx<;WqLJ?*5T^r2PTdsX9g@< zj14SC423n$pJ*717&_-Gmf$WF)SkY#`}Cw5aqzjYEKGgwI zG_#WI)JpDG`9AGrqmr|7FNDiPhvJ4lDkS<;b}rq@jgk*0RL{fhhr>fPN#3Ht{R45b z3$&40rdIHVJh#*`+N&B;!He+JNyN6G?_L>AUNlf)Y+7^U*@5^CT|d|jm=`6KkqH(E z8g*Q*530(%&}sHoyX>^GO)JsH_sMz4+k ze&UyfdR~mq`2_Tg$NE5GR@3Qn%S^A~yBBxN8d#{~Vtq6BwZ71v$%9YE7wc_8oF6!( zyL={)lWEN=_NiZtNtn$RE(>Z6-+PdHBjj^iAC~5{KT&1*Km`Nb{G3B+b@?9g)_az& zztwQ)_q@}-zuhYF9Y*=%{s+j)pgeNCtK@}Ne{@*$ZJ6brpF9jN zloRW(w3brvg2zDt8@rdgxMP>v)_r`mjdW>I{cuBTQI`20@#2_vacWOt)q^yjq8X1y zfG?kz&kIvhnXA>Q%t7w*yIFsz%fjpoPgNB$K0R9q-MX2iS-0F_Q`x~Yv@|Zb*E5xq zRC+BX+n3<%l%9XQqt{Op7k8&v?a%K{{49om__J^}8j!hhZ7MjuGOk4|S{N zV~ACeBS1}c7-M^L?7E6%K%s$@Q4Qw*0ovCz9(QRM=(1 zc8L9$!rOOmr9in|E=!8=z_JPMU6- z@_2m&%fr3|D0*>@8-DDtDu~jLA9XiqAx{&Uk0mR9<+MnDhp-+{w%N_h2bKrwdnaQasDykay-oH;h}5HL}F)$+{n zY>FBz!;4RjSR(@-k>gBt>LVw(`$ACZ_X88VWJQ9u(M$E}CoK}Pvd;#cd{r1Vh)AwX z?)U5cGs(uKkez9gt|&>G-)XX4LAl)d^wv_dvu9DQ4!O;Rp7nGWr`WZL+H`bZ2s5l5 z`SC=PWU%~Qf3(tp(8QrNI+1R`KJL`>x$f?hZI=^0;j-(MRj`5n@dW+3n#vcPM{miF4(~tW5m65EnXIHKKRt#G;|r zhix(1{+Cl^Ye>vT8BNVUHuVu(2DP}XievwYn@47#)A>2&anrToBl^^u5kGAi;M8(U zka_!W&dAgf_UoY&*7`=L%p2-@$!=to6v?_a)hFj4*?_TQMb(SXmDVa6m}xf6U(G65 z;;d_l47v*&Qui{s?^+F4hRfFaPKj-zN4+nJ^qUpr5ZVgQw_gtp>W@+*7oj8!?V;Qy zYFJjqwZ!5Y^uMf3PmH#UiNR_q3Wl{}-**Al3i? literal 0 HcmV?d00001 diff --git a/app/controllers/users/omniauth_callbacks_controller.rb b/app/controllers/users/omniauth_callbacks_controller.rb index 27b884710..7b0bff2b9 100644 --- a/app/controllers/users/omniauth_callbacks_controller.rb +++ b/app/controllers/users/omniauth_callbacks_controller.rb @@ -1,6 +1,10 @@ module Users class OmniauthCallbacksController < Devise::OmniauthCallbacksController + include UsersGenerator + skip_before_action :verify_authenticity_token + before_action :sign_up_with_provider_enabled?, + only: :linkedin # You should configure your model like this: # devise :omniauthable, omniauth_providers: [:twitter] @@ -9,6 +13,55 @@ module Users # def twitter # end + def linkedin + auth_hash = request.env['omniauth.auth'] + + @user = User.from_omniauth(auth_hash) + if @user && @user.current_team_id? + # User already exists and has been signed up with LinkedIn; just sign in + set_flash_message(:notice, + :success, + kind: I18n.t('devise.linkedin.provider_name')) + sign_in_and_redirect @user + elsif @user + # User already exists and has started sign up with LinkedIn; + # but doesn't have team (needs to complete sign up - agrees to TOS) + set_flash_message(:alert, + :failure, + kind: I18n.t('devise.linkedin.provider_name'), + reason: I18n.t('devise.linkedin.complete_sign_up')) + redirect_to users_sign_up_provider_path(user: @user) + elsif User.find_by_email(auth_hash['info']['email']) + # email is already taken, so sign up with Linked in is not allowed + set_flash_message(:alert, + :failure, + kind: I18n.t('devise.linkedin.provider_name'), + reason: I18n.t('devise.linkedin.email_already_taken', + email: auth_hash['info']['email'])) + redirect_to after_omniauth_failure_path_for(resource_name) + else + # Create new user and identity; and redirect to complete sign up form + @user = User.new( + full_name: auth_hash['info']['name'], + initials: generate_initials(auth_hash['info']['name']), + email: auth_hash['info']['email'], + password: generate_user_password + ) + @user.avatar_remote_url = (auth_hash['info']['image']) + user_identity = UserIdentity.new(user: @user, + provider: auth_hash['provider'], + uid: auth_hash['uid']) + unless @user.save && user_identity.save + set_flash_message(:alert, + :failure, + kind: I18n.t('devise.linkedin.provider_name'), + reason: I18n.t('devise.linkedin.failed_to_save')) + redirect_to after_omniauth_failure_path_for(resource_name) and return + end + redirect_to users_sign_up_provider_path(user: @user) + end + end + # More info at: # https://github.com/plataformatec/devise#omniauth @@ -28,5 +81,18 @@ module Users # def after_omniauth_failure_path_for(scope) # super(scope) # end + + private + + def sign_up_with_provider_enabled? + render_403 unless Rails.configuration.x.enable_user_registration + render_403 unless Rails.configuration.x.linkedin_signin_enabled + end + + def generate_initials(full_name) + initials = full_name.titleize.scan(/[A-Z]+/).join + initials = initials.strip.empty? ? 'PLCH' : initials[0..3] + initials + end end end diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index dbda51b4a..f127dfd13 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -1,5 +1,9 @@ class Users::RegistrationsController < Devise::RegistrationsController prepend_before_action :check_captcha, only: [:create] + before_action :registration_enabled?, + only: %i(new create new_with_provider create_with_provider) + before_action :sign_up_with_provider_enabled?, + only: %i(new_with_provider create_with_provider) def avatar user = User.find_by_id(params[:id]) || current_user @@ -122,12 +126,9 @@ class Users::RegistrationsController < Devise::RegistrationsController end end - def new - render_403 && return unless Rails.configuration.x.enable_user_registration - end + def new; end def create - render_403 && return unless Rails.configuration.x.enable_user_registration build_resource(sign_up_params) valid_resource = resource.valid? # ugly checking if new team on sign up is enabled :( @@ -174,6 +175,36 @@ class Users::RegistrationsController < Devise::RegistrationsController end end + def new_with_provider; end + + def create_with_provider + @user = User.find_by_id(user_provider_params['user']) + # Create new team for the new user + @team = Team.new(team_provider_params) + @team.validate + + if @team.valid? && Rails.configuration.x.new_team_on_signup + # Set the confirmed_at == created_at IF not using email confirmations + unless Rails.configuration.x.enable_email_confirmations + @user.update!(confirmed_at: @user.created_at) + end + + @team.created_by = @user # set created_by for team + @team.save! + + # Add this user to the team as owner + UserTeam.create(user: @user, team: @team, role: :admin) + + # set current team to new user + @user.current_team_id = @team.id + @user.save! + + sign_in_and_redirect @user + else + render :new_with_provider + end + end + protected # Called upon creating User (before .save). Permits parameters and extracts @@ -191,6 +222,14 @@ class Users::RegistrationsController < Devise::RegistrationsController tmp.merge(:initials => initials) end + def team_provider_params + params.require(:team).permit(:name) + end + + def user_provider_params + params.permit(:user) + end + def account_update_params params.require(:user).permit( :full_name, @@ -268,6 +307,14 @@ class Users::RegistrationsController < Devise::RegistrationsController end end + def registration_enabled? + render_403 unless Rails.configuration.x.enable_user_registration + end + + def sign_up_with_provider_enabled? + render_403 unless Rails.configuration.x.linkedin_signin_enabled + end + # Redirect to login page after signing up def after_sign_up_path_for(resource) new_user_session_path diff --git a/app/models/user.rb b/app/models/user.rb index e9265fbc6..cca3b9409 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -217,6 +217,14 @@ class User < ApplicationRecord self.full_name = name end + def avatar_remote_url=(url_value) + self.avatar = URI.parse(url_value) + # Assuming url_value is http://example.com/photos/face.png + # avatar_file_name == "face.png" + # avatar_content_type == "image/png" + @avatar_remote_url = url_value + end + def current_team Team.find_by_id(self.current_team_id) end diff --git a/app/views/users/registrations/new_with_provider.html.erb b/app/views/users/registrations/new_with_provider.html.erb new file mode 100644 index 000000000..2feddd300 --- /dev/null +++ b/app/views/users/registrations/new_with_provider.html.erb @@ -0,0 +1,37 @@ +<% provide(:head_title, t('users.registrations.new.head_title')) %> + +
    +

    <%= t 'users.registrations.new_with_provider.head_title' %>

    +
    + <%= form_for(:team, as: resource_name, url: users_complete_sign_up_provider_path, html: { id: "sign-up-provider-form" } ) do |f| %> + <%= hidden_field_tag :user, params['user'] %> + + <% if Rails.configuration.x.new_team_on_signup %> +
    + <%= f.label :name, t('users.registrations.new.team_name_label') %> + <%= f.text_field :name, autofocus: true, class: 'form-control' %> + <%= t 'users.registrations.new.team_name_help' %> +
    + <% end %> + +
    + <%= f.submit 'Sign up', class: 'btn btn-primary' %> +
    + <% end %> +
    + <%= render 'users/shared/links' %> +
    + +<% if @team and not @team.errors.empty? %> + +<% end %> diff --git a/app/views/users/shared/_links.html.erb b/app/views/users/shared/_links.html.erb index c98abe826..f0d9d4fea 100644 --- a/app/views/users/shared/_links.html.erb +++ b/app/views/users/shared/_links.html.erb @@ -1,5 +1,7 @@ <%- if controller_name != 'sessions' %> - <%= link_to t("devise.links.login"), new_session_path(resource_name) %>
    + <% login = t("devise.links.login") %> + <% login = t("devise.links.login_with_provider") if ['new_with_provider', 'create_with_provider'].include? action_name %> + <%= link_to login, new_session_path(resource_name) %>
    <% end -%> <%- if devise_mapping.registerable? && Rails.configuration.x.enable_user_registration && controller_name != 'registrations' %> @@ -21,3 +23,14 @@ <%- if devise_mapping.omniauthable? && resource_class.omniauth_providers.any? %>
    <% end -%> + +<%- if Rails.configuration.x.enable_user_registration && Rails.configuration.x.linkedin_signin_enabled %> + <%- if devise_mapping.omniauthable? && resource_class.omniauth_providers.any? && controller_name != 'registrations' %> + <%= link_to omniauth_authorize_path(resource_name, :linkedin), :title => "Sign in with LinkedIn" do %> + <%= image_tag 'linkedin/Sign-in-Small---Default.png', alt: "Sign in with LinkedIn", + onmouseover: "src='#{image_path('linkedin/Sign-in-Small---Hover.png')}'", + onmouseout: "src='#{image_path('linkedin/Sign-in-Small---Default.png')}'", + onclick: "src='#{image_path('linkedin/Sign-in-Small---Active.png')}'" %> + <% end -%> + <% end -%> +<% end -%> diff --git a/config/environments/development.rb b/config/environments/development.rb index 5f6bbe557..8ad2dc82a 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -102,6 +102,9 @@ Rails.application.configure do config.x.enable_user_registration = ENV['ENABLE_USER_REGISTRATION'] == 'false' ? false : true + # Enable sign in with LinkedIn account + config.x.linkedin_signin_enabled = ENV['LINKEDIN_SIGNIN_ENABLED'] == 'true' + # Use an evented file watcher to asynchronously detect changes in source code, # routes, locales, etc. This feature depends on the listen gem. #config.file_watcher = ActiveSupport::EventedFileUpdateChecker diff --git a/config/environments/production.rb b/config/environments/production.rb index 79504c7dc..21584572d 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -116,6 +116,9 @@ Rails.application.configure do config.x.enable_user_registration = ENV['ENABLE_USER_REGISTRATION'] == 'false' ? false : true + # Enable sign in with LinkedIn account + config.x.linkedin_signin_enabled = ENV['LINKEDIN_SIGNIN_ENABLED'] == 'true' + # Use a different logger for distributed setups. # require 'syslog/logger' # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new 'app-name') diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index af1646826..3929886a6 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -287,6 +287,8 @@ Devise.setup do |config| # Add a new OmniAuth provider. Check the wiki for more information on setting # up on your models and hooks. # config.omniauth :github, 'APP_ID', 'APP_SECRET', scope: 'user,public_repo' + config.omniauth :linkedin, ENV['LINKEDIN_KEY'], ENV['LINKEDIN_SECRET'], + scope: %w(r_basicprofile r_emailaddress) # ==> Warden configuration # If you want to use other strategies, that are not supported by Devise, or diff --git a/config/initializers/extends.rb b/config/initializers/extends.rb index 709c25017..37b9e1282 100644 --- a/config/initializers/extends.rb +++ b/config/initializers/extends.rb @@ -41,7 +41,8 @@ class Extends # Data type name should match corresponding model's name REPOSITORY_DATA_TYPES = { RepositoryTextValue: 0, - RepositoryDateValue: 1 } + RepositoryDateValue: 1, + RepositoryListValue: 2 } # List of implemented core API versions API_VERSIONS = ['20170715'] @@ -49,7 +50,7 @@ class Extends # Array used for injecting names of additional authentication methods for API API_PLUGABLE_AUTH_METHODS = [] - OMNIAUTH_PROVIDERS = [] + OMNIAUTH_PROVIDERS = [:linkedin, *(:developer if Rails.env.development?)] INITIAL_USER_OPTIONS = {} end diff --git a/config/initializers/paperclip.rb b/config/initializers/paperclip.rb index c88f1dccc..392784c53 100644 --- a/config/initializers/paperclip.rb +++ b/config/initializers/paperclip.rb @@ -11,6 +11,8 @@ Paperclip::Attachment.default_options.merge!( url: '/system/:class/:attachment/:id_partition/:hash/:style/:filename' ) +Paperclip::UriAdapter.register + if ENV['PAPERCLIP_STORAGE'] == "s3" if ENV['S3_BUCKET'].nil? or ENV['AWS_REGION'].nil? or diff --git a/config/locales/en.yml b/config/locales/en.yml index 6db4618fa..f508e4616 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -40,11 +40,17 @@ en: submit: "Resend unlock instructions" links: login: "Log in" + login_with_provider: "Log in with SciNote account" signup: "Sign up" forgot: "Forgot your password?" not_receive_confirmation: "Didn't receive confirmation instructions?" not_receive_unlock: "Didn't receive unlock instructions?" sign_in_provider: "Sign in with %{provider}" + linkedin: + provider_name: "LinkedIn" + complete_sign_up: "You have to complete the sign up process" + email_already_taken: "SciNote account with email %{email} alreday exists" + failed_to_save: "Failed to create new user" helpers: label: @@ -1272,6 +1278,8 @@ en: head_title: "Sign up" team_name_label: "Team name" team_name_help: "Team name is required in order to create your own Team. After you create your own Team, you will be able to join other Teams as well." + new_with_provider: + head_title: "Complete the Sign up" statistics: title: "My statistics" team: "Team" diff --git a/config/routes.rb b/config/routes.rb index 5679d1157..1e7afbb88 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -498,6 +498,8 @@ Rails.application.routes.draw do get 'avatar/:id/:style' => 'users/registrations#avatar', as: 'avatar' post 'avatar_signature' => 'users/registrations#signature' get 'users/auth_token_sign_in' => 'users/sessions#auth_token_create' + get 'users/sign_up_provider' => 'users/registrations#new_with_provider' + post 'users/complete_sign_up_provider' => 'users/registrations#create_with_provider' end namespace :api, defaults: { format: 'json' } do diff --git a/lib/tasks/data.rake b/lib/tasks/data.rake index 44be9f9b8..ab102ada9 100644 --- a/lib/tasks/data.rake +++ b/lib/tasks/data.rake @@ -69,6 +69,12 @@ namespace :data do .where.not(invitation_token: nil) .where("created_at < ?", Devise.invite_for.ago) destroy_users(users) + + # Remove users who didn't finish signup with LinkedIn + users = User.joins(:user_identities) + .where(confirmed_at: nil) + #.where('created_at < ?', Devise.confirm_within.ago) + destroy_users(users) end desc "Remove temporary and obsolete data" From bdc124faa0dd44acc948550af444c07065df06fb Mon Sep 17 00:00:00 2001 From: Luka Murn Date: Thu, 1 Mar 2018 07:50:55 +0100 Subject: [PATCH 30/59] Bump VERSION to 1.12.11 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 393ccdb5b..e6e1ff3ac 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.12.10 +1.12.11 From 9199f287baf905a5cf8aa970032d3d285a11adcd Mon Sep 17 00:00:00 2001 From: mlorb Date: Thu, 1 Mar 2018 09:18:36 +0100 Subject: [PATCH 31/59] fix hound --- config/initializers/extends.rb | 5 ++--- config/routes.rb | 3 ++- lib/tasks/data.rake | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/initializers/extends.rb b/config/initializers/extends.rb index 37b9e1282..6e579e31b 100644 --- a/config/initializers/extends.rb +++ b/config/initializers/extends.rb @@ -41,8 +41,7 @@ class Extends # Data type name should match corresponding model's name REPOSITORY_DATA_TYPES = { RepositoryTextValue: 0, - RepositoryDateValue: 1, - RepositoryListValue: 2 } + RepositoryDateValue: 1 } # List of implemented core API versions API_VERSIONS = ['20170715'] @@ -50,7 +49,7 @@ class Extends # Array used for injecting names of additional authentication methods for API API_PLUGABLE_AUTH_METHODS = [] - OMNIAUTH_PROVIDERS = [:linkedin, *(:developer if Rails.env.development?)] + OMNIAUTH_PROVIDERS = [:linkedin] INITIAL_USER_OPTIONS = {} end diff --git a/config/routes.rb b/config/routes.rb index 1e7afbb88..900af2b0c 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -499,7 +499,8 @@ Rails.application.routes.draw do post 'avatar_signature' => 'users/registrations#signature' get 'users/auth_token_sign_in' => 'users/sessions#auth_token_create' get 'users/sign_up_provider' => 'users/registrations#new_with_provider' - post 'users/complete_sign_up_provider' => 'users/registrations#create_with_provider' + get 'users/completesign_up_provider' => + 'users/registrations#create_with_provider' end namespace :api, defaults: { format: 'json' } do diff --git a/lib/tasks/data.rake b/lib/tasks/data.rake index ab102ada9..6bdb52ec7 100644 --- a/lib/tasks/data.rake +++ b/lib/tasks/data.rake @@ -73,7 +73,7 @@ namespace :data do # Remove users who didn't finish signup with LinkedIn users = User.joins(:user_identities) .where(confirmed_at: nil) - #.where('created_at < ?', Devise.confirm_within.ago) + .where('created_at < ?', Devise.confirm_within.ago) destroy_users(users) end From e66eab7f57631e4151b5b3811133cabf41bdc113 Mon Sep 17 00:00:00 2001 From: mlorb Date: Thu, 1 Mar 2018 09:45:52 +0100 Subject: [PATCH 32/59] fix typo --- config/routes.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/routes.rb b/config/routes.rb index 900af2b0c..df566e5a8 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -499,7 +499,7 @@ Rails.application.routes.draw do post 'avatar_signature' => 'users/registrations#signature' get 'users/auth_token_sign_in' => 'users/sessions#auth_token_create' get 'users/sign_up_provider' => 'users/registrations#new_with_provider' - get 'users/completesign_up_provider' => + get 'users/complete_sign_up_provider' => 'users/registrations#create_with_provider' end From f5949e9d10f0e95fe91eeb09a4eef83cf2d81792 Mon Sep 17 00:00:00 2001 From: mlorb Date: Thu, 1 Mar 2018 17:52:24 +0100 Subject: [PATCH 33/59] refactor --- app/controllers/users/registrations_controller.rb | 3 +-- app/views/users/shared/_links.html.erb | 2 +- config/initializers/devise.rb | 6 ++++-- config/routes.rb | 4 ++-- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index f127dfd13..6d4ea797f 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -181,9 +181,8 @@ class Users::RegistrationsController < Devise::RegistrationsController @user = User.find_by_id(user_provider_params['user']) # Create new team for the new user @team = Team.new(team_provider_params) - @team.validate - if @team.valid? && Rails.configuration.x.new_team_on_signup + if @team.valid? && @user.valid? && Rails.configuration.x.new_team_on_signup # Set the confirmed_at == created_at IF not using email confirmations unless Rails.configuration.x.enable_email_confirmations @user.update!(confirmed_at: @user.created_at) diff --git a/app/views/users/shared/_links.html.erb b/app/views/users/shared/_links.html.erb index f0d9d4fea..654e82a97 100644 --- a/app/views/users/shared/_links.html.erb +++ b/app/views/users/shared/_links.html.erb @@ -1,6 +1,6 @@ <%- if controller_name != 'sessions' %> <% login = t("devise.links.login") %> - <% login = t("devise.links.login_with_provider") if ['new_with_provider', 'create_with_provider'].include? action_name %> + <% login = t("devise.links.login_with_provider") if action_name.in? %w(new_with_provider create_with_provider) %> <%= link_to login, new_session_path(resource_name) %>
    <% end -%> diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index 3929886a6..8b7f0ac96 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -287,8 +287,10 @@ Devise.setup do |config| # Add a new OmniAuth provider. Check the wiki for more information on setting # up on your models and hooks. # config.omniauth :github, 'APP_ID', 'APP_SECRET', scope: 'user,public_repo' - config.omniauth :linkedin, ENV['LINKEDIN_KEY'], ENV['LINKEDIN_SECRET'], - scope: %w(r_basicprofile r_emailaddress) + if Rails.configuration.x.enable_user_registration + config.omniauth :linkedin, ENV['LINKEDIN_KEY'], ENV['LINKEDIN_SECRET'], + scope: %w(r_basicprofile r_emailaddress) + end # ==> Warden configuration # If you want to use other strategies, that are not supported by Devise, or diff --git a/config/routes.rb b/config/routes.rb index df566e5a8..80aa7d021 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -499,8 +499,8 @@ Rails.application.routes.draw do post 'avatar_signature' => 'users/registrations#signature' get 'users/auth_token_sign_in' => 'users/sessions#auth_token_create' get 'users/sign_up_provider' => 'users/registrations#new_with_provider' - get 'users/complete_sign_up_provider' => - 'users/registrations#create_with_provider' + post 'users/complete_sign_up_provider' => + 'users/registrations#create_with_provider' end namespace :api, defaults: { format: 'json' } do From d4e62c3c1370893544e54b67cf61ab203c4329a6 Mon Sep 17 00:00:00 2001 From: mlorb Date: Thu, 1 Mar 2018 18:03:13 +0100 Subject: [PATCH 34/59] add Gemfile.lock --- Gemfile.lock | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/Gemfile.lock b/Gemfile.lock index 386d75f4b..c811bb108 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -215,6 +215,8 @@ GEM railties (>= 3.0.0) faker (1.8.7) i18n (>= 0.7) + faraday (0.12.2) + multipart-post (>= 1.2, < 3) ffi (1.9.18) figaro (1.1.1) thor (~> 0.14) @@ -289,6 +291,8 @@ GEM railties (>= 3.1) multi_json (1.13.1) multi_test (0.1.2) + multi_xml (0.6.0) + multipart-post (2.0.0) nested_form_fields (0.8.2) coffee-rails (>= 3.2.1) jquery-rails @@ -299,10 +303,22 @@ GEM mini_portile2 (~> 2.3.0) nokogumbo (1.4.13) nokogiri + oauth2 (1.4.0) + faraday (>= 0.8, < 0.13) + jwt (~> 1.0) + multi_json (~> 1.3) + multi_xml (~> 0.5) + rack (>= 1.2, < 3) oj (3.3.10) omniauth (1.8.1) hashie (>= 3.4.6, < 3.6.0) rack (>= 1.6.2, < 3) + omniauth-linkedin-oauth2 (0.2.5) + omniauth (~> 1.0) + omniauth-oauth2 + omniauth-oauth2 (1.5.0) + oauth2 (~> 1.1) + omniauth (~> 1.2) orm_adapter (0.5.0) paperclip (5.2.1) activemodel (>= 4.2.0) @@ -559,6 +575,7 @@ DEPENDENCIES newrelic_rpm nokogiri (~> 1.8.1) omniauth + omniauth-linkedin-oauth2 paperclip (~> 5.1) pg (~> 0.18) phantomjs From d19ca7fbdcbb4b6904bd25b31d33ac80b3742822 Mon Sep 17 00:00:00 2001 From: mlorb Date: Fri, 2 Mar 2018 16:32:46 +0100 Subject: [PATCH 35/59] change validation --- app/controllers/users/registrations_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index 6d4ea797f..b942a93ac 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -182,7 +182,7 @@ class Users::RegistrationsController < Devise::RegistrationsController # Create new team for the new user @team = Team.new(team_provider_params) - if @team.valid? && @user.valid? && Rails.configuration.x.new_team_on_signup + if @team.valid? && @user.present? && Rails.configuration.x.new_team_on_signup # Set the confirmed_at == created_at IF not using email confirmations unless Rails.configuration.x.enable_email_confirmations @user.update!(confirmed_at: @user.created_at) From 350f12bdbc96d0627674ff024afa1cfd7f6c7fae Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Fri, 2 Mar 2018 22:29:51 +0100 Subject: [PATCH 36/59] using dig method now --- app/helpers/protocols_io_helper.rb | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index ae2a45499..b1437bec1 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -151,25 +151,8 @@ module ProtocolsIoHelper end def step_hash_null?(step_json) - is_null_check = false - if step_json.blank? - is_null_check = true - elsif step_json[0].blank? - is_null_check = true - elsif step_json[0]['components'].blank? - is_null_check = true - elsif step_json[0]['components'][0].blank? - is_null_check = true - elsif step_json[0]['components'][0]['component_type_id'].blank? - is_null_check = true - else - is_null_check = false - end - if is_null_check - return true - else - return false - end + return true if step_json.dig(0, 'components', 0, 'component_type_id').nil? + false end # Images are allowed in: From 5bcda7f6de22d05ab0234d13ef26f555bf3157df Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Fri, 2 Mar 2018 23:02:35 +0100 Subject: [PATCH 37/59] fixed pr --- app/helpers/protocols_io_helper.rb | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index a29d1baf6..adf33971c 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -52,7 +52,7 @@ module ProtocolsIoHelper tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count diff = 5 - tr_number # always tables have atleast 5 rows - table_fix_str = tr_number > 4 ? table[0] : table[0] + empty_tbl_gen(diff) + table_fix_str = tr_number > 4 ? table[0] : table[0] + '' * diff tr_strings = table_fix_str.scan(tr_regex) contents = {} contents['data'] = [] @@ -66,10 +66,7 @@ module ProtocolsIoHelper contents['data'][tr_counter].push(td_stripped) end next if td_counter >= 5 - while diff > 0 - contents['data'][tr_counter].push(' ') - diff -= 1 - end + diff.times { contents['data'][tr_counter].push(' ') } end tables[table_counter.to_s]['contents'] = Base64.encode64( contents.to_s.sub('=>', ':') @@ -79,15 +76,6 @@ module ProtocolsIoHelper return tables, string_without_tables end - def empty_tbl_gen(number) - result = '' - while number > 0 - result += '' - number -= 1 - end - result - end - def string_html_table_remove(description_string) description_string.remove!("\n", "\t", "\r", "\f") table_whole_regex = %r{(]*>.*?<\/table>)}m From ba67446eeea8e2840d8deca616711754b8d04247 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Sat, 3 Mar 2018 22:26:00 +0100 Subject: [PATCH 38/59] quick fix for if previous guid is unknown format --- app/helpers/protocols_io_helper.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index d9fb01648..18998dc2e 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -322,6 +322,7 @@ module ProtocolsIoHelper def protocols_io_guid_reorder_step_json(unordered_step_json) base_step = unordered_step_json.find { |step| step['previous_guid'].nil? } + return unordered_step_json if base_step.nil? number_of_steps = unordered_step_json.size step_order = [] step_counter = 0 From 5724f8ed4de240d96c71d1f23c5c26fc0abf7539 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Sun, 4 Mar 2018 14:19:17 +0100 Subject: [PATCH 39/59] Minor permissions refactoring, including putting the same checks for multiple permissions before the specific ones, hence preventing further evaluation if those permissions are not met. --- app/permissions/experiment.rb | 117 +++++++++++++++++++--------------- app/permissions/project.rb | 40 ++++++------ 2 files changed, 86 insertions(+), 71 deletions(-) diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index 320da0d2f..a8a0cde7f 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -1,4 +1,17 @@ Canaid::Permissions.register_for(Experiment) do + # Experiment and its project must be active for all the specified permissions + %i(read_experiment + manage_experiment + archive_experiment + clone_experiment + move_experiment) + .each do |perm| + can perm do |_, experiment| + experiment.active? && + experiment.project.active? + end + end + # experiment: read (read archive) # canvas: read # module: read (read users, read comments, read archive) @@ -38,21 +51,24 @@ Canaid::Permissions.register_for(Experiment) do can :move_experiment do |user, experiment| can_clone_experiment?(user, experiment) end - # Experiment and its project must be active for all the specified permissions - %i(read_experiment - manage_experiment - archive_experiment - clone_experiment - move_experiment) - .each do |perm| - can perm do |_, experiment| - experiment.active? && - experiment.project.active? - end - end end Canaid::Permissions.register_for(MyModule) do + # Module, its experiment and its project must be active for all the specified + # permissions + %i(manage_module + manage_users_in_module + assign_sample_to_module + complete_module + create_comments_in_module) + .each do |perm| + can perm do |_, my_module| + my_module.active? && + my_module.experiment.active? && + my_module.experiment.project.active? + end + end + # module: update, archive, move # result: create, update can :manage_module do |user, my_module| @@ -89,22 +105,34 @@ Canaid::Permissions.register_for(MyModule) do can :create_comments_in_module do |user, my_module| can_create_comments_in_project?(user, my_module.experiment.project) end +end + +Canaid::Permissions.register_for(Protocol) do + # Protocol needs to be in a module for all Protocol permissions below + # experiment level + %i(read_protocol_in_module + manage_protocol_in_module + complete_or_checkbox_step) + .each do |perm| + can perm do |_, protocol| + protocol.in_module? + end + end + # Module, its experiment and its project must be active for all the specified # permissions - %i(manage_module - manage_users_in_module - assign_sample_to_module - complete_module - create_comments_in_module).each do |perm| - can perm do |_, my_module| + %i(read_protocol_in_module + manage_protocol_in_module + complete_or_checkbox_step) + .each do |perm| + can perm do |_, protocol| + my_module = protocol.my_module my_module.active? && my_module.experiment.active? && my_module.experiment.project.active? end end -end -Canaid::Permissions.register_for(Protocol) do # protocol in module: read # step in module: read, read comments, read/download assets can :read_protocol_in_module do |user, protocol| @@ -135,29 +163,9 @@ Canaid::Permissions.register_for(Protocol) do false end end - - # Module, its experiment and its project must be active for all the specified - # permissions - %i(read_protocol_in_module - manage_protocol_in_module - complete_or_checkbox_step) - .each do |perm| - can perm do |_, protocol| - my_module = protocol.my_module - my_module.active? && - my_module.experiment.active? && - my_module.experiment.project.active? - end - end end Canaid::Permissions.register_for(Result) do - # result: delete, archive - can :manage_result do |user, result| - result.unlocked?(result) && - user.is_owner_of_project?(result.my_module.experiment.project) - end - # Module, its experiment and its project must be active for all the specified # permissions %i(manage_result).each do |perm| @@ -168,9 +176,27 @@ Canaid::Permissions.register_for(Result) do my_module.experiment.project.active? end end + + # result: delete, archive + can :manage_result do |user, result| + result.unlocked?(result) && + user.is_owner_of_project?(result.my_module.experiment.project) + end end Canaid::Permissions.register_for(Comment) do + # Module, its experiment and its project must be active for all the specified + # permissions + %i(manage_comment_in_module) + .each do |perm| + can perm do |_, comment| + my_module = ::PermissionsUtil.get_comment_module(comment) + my_module.active? && + my_module.experiment.active? && + my_module.experiment.project.active? + end + end + # module: update/delete comment # result: update/delete comment # step: update/delete comment @@ -181,15 +207,4 @@ Canaid::Permissions.register_for(Comment) do project.present? && (user.is_owner_of_project?(project) || comment.user == user) end - - # Module, its experiment and its project must be active for all the specified - # permissions - %i(manage_comment_in_module).each do |perm| - can perm do |_, comment| - my_module = ::PermissionsUtil.get_comment_module(comment) - my_module.active? && - my_module.experiment.active? && - my_module.experiment.project.active? - end - end end diff --git a/app/permissions/project.rb b/app/permissions/project.rb index cfe1ab766..b95c8d342 100644 --- a/app/permissions/project.rb +++ b/app/permissions/project.rb @@ -1,4 +1,18 @@ Canaid::Permissions.register_for(Project) do + # Project must be active for all the specified permissions + %i(read_project + manage_project + archive_project + create_experiments + create_comments_in_project + manage_tags + manage_reports) + .each do |perm| + can perm do |_, project| + project.active? + end + end + # project: read, read activities, read comments, read users, read archive, # read notifications # reports: read @@ -46,29 +60,9 @@ Canaid::Permissions.register_for(Project) do can :manage_reports do |user, project| user.is_technician_or_higher_of_project?(project) end - - # Project must be active for all the specified permissions - %i(read_project - manage_project - archive_project - create_experiments - create_comments_in_project - manage_tags - manage_reports) - .each do |perm| - can perm do |_, project| - project.active? - end - end end Canaid::Permissions.register_for(ProjectComment) do - # project: update/delete comment - can :manage_comment_in_project do |user, project_comment| - project_comment.project.present? && (project_comment.user == user || - user.is_owner_of_project?(project)) - end - # Project must be active for all the specified permissions %i(manage_comment_in_project) .each do |perm| @@ -76,4 +70,10 @@ Canaid::Permissions.register_for(ProjectComment) do project_comment.project.active? end end + + # project: update/delete comment + can :manage_comment_in_project do |user, project_comment| + project_comment.project.present? && (project_comment.user == user || + user.is_owner_of_project?(project)) + end end From 53f75f3cd6444edb107cb3cd590882c893ef0afd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Sun, 4 Mar 2018 14:49:28 +0100 Subject: [PATCH 40/59] Minor permissions and their calls refactoring and fixing. --- app/controllers/my_module_tags_controller.rb | 2 +- app/controllers/user_my_modules_controller.rb | 2 +- app/permissions/project.rb | 2 +- .../canvas/edit/modal/_move_module.html.erb | 2 +- app/views/my_module_tags/_index_edit.html.erb | 60 +++++++++---------- app/views/user_my_modules/_index.html.erb | 2 +- .../user_my_modules/_index_edit.html.erb | 4 +- 7 files changed, 34 insertions(+), 40 deletions(-) diff --git a/app/controllers/my_module_tags_controller.rb b/app/controllers/my_module_tags_controller.rb index f56992bff..79ff20cb5 100644 --- a/app/controllers/my_module_tags_controller.rb +++ b/app/controllers/my_module_tags_controller.rb @@ -78,7 +78,7 @@ class MyModuleTagsController < ApplicationController end def check_manage_permissions - render_403 unless can_manage_module?(@my_module) + render_403 unless can_manage_tags?(@my_module.experiment.project) end def init_gui diff --git a/app/controllers/user_my_modules_controller.rb b/app/controllers/user_my_modules_controller.rb index 68db8b360..de02df711 100644 --- a/app/controllers/user_my_modules_controller.rb +++ b/app/controllers/user_my_modules_controller.rb @@ -137,7 +137,7 @@ class UserMyModulesController < ApplicationController end def check_manage_permissions - render_403 unless manage_users_in_module?(@my_module) + render_403 unless can_manage_users_in_module?(@my_module) end def init_gui diff --git a/app/permissions/project.rb b/app/permissions/project.rb index b95c8d342..3b07cf6cd 100644 --- a/app/permissions/project.rb +++ b/app/permissions/project.rb @@ -74,6 +74,6 @@ Canaid::Permissions.register_for(ProjectComment) do # project: update/delete comment can :manage_comment_in_project do |user, project_comment| project_comment.project.present? && (project_comment.user == user || - user.is_owner_of_project?(project)) + user.is_owner_of_project?(project_comment.project)) end end diff --git a/app/views/canvas/edit/modal/_move_module.html.erb b/app/views/canvas/edit/modal/_move_module.html.erb index 491ba9ff5..6c5d32a8a 100644 --- a/app/views/canvas/edit/modal/_move_module.html.erb +++ b/app/views/canvas/edit/modal/_move_module.html.erb @@ -6,7 +6,7 @@
    - <% experiments = @experiment.project.experiments %> + <% experiments = @experiment.project.experiments.is_archived(false) %> <% if experiments.count > 1 %> <%= bootstrap_form_tag do |f| %> <%= f.select :experiment_id, experiments diff --git a/app/views/my_module_tags/_index_edit.html.erb b/app/views/my_module_tags/_index_edit.html.erb index 8ec64984a..7564ad3f8 100644 --- a/app/views/my_module_tags/_index_edit.html.erb +++ b/app/views/my_module_tags/_index_edit.html.erb @@ -11,42 +11,38 @@

    <%= tag.name %>

    - <% if can_manage_tags?(@my_module.experiment.project) %> - <%= link_to "", remote: true, class: 'btn btn-link edit-tag-link', title: t("experiments.canvas.modal_manage_tags.edit_tag") do %> - - <% end %> - <%= link_to my_module_my_module_tag_path(@my_module, mmt, format: :json), method: :delete, remote: true, class: 'btn btn-link remove-tag-link', title: t("experiments.canvas.modal_manage_tags.remove_tag", module: @my_module.name) do %> - - <% end %> - <%= bootstrap_form_for tag, remote: true, url: project_tag_path(@my_module.experiment.project, tag, format: :json), method: :delete, html: { class: "delete-tag-form"} do |f| %> - <%= hidden_field_tag :my_module_id, @my_module.id %> - <%= f.button class: 'btn btn-link delete-tag-link', title: t("experiments.canvas.modal_manage_tags.delete_tag") do %> - - <% end %> + <%= link_to "", remote: true, class: 'btn btn-link edit-tag-link', title: t("experiments.canvas.modal_manage_tags.edit_tag") do %> + + <% end %> + <%= link_to my_module_my_module_tag_path(@my_module, mmt, format: :json), method: :delete, remote: true, class: 'btn btn-link remove-tag-link', title: t("experiments.canvas.modal_manage_tags.remove_tag", module: @my_module.name) do %> + + <% end %> + <%= bootstrap_form_for tag, remote: true, url: project_tag_path(@my_module.experiment.project, tag, format: :json), method: :delete, html: { class: "delete-tag-form"} do |f| %> + <%= hidden_field_tag :my_module_id, @my_module.id %> + <%= f.button class: 'btn btn-link delete-tag-link', title: t("experiments.canvas.modal_manage_tags.delete_tag") do %> + <% end %> <% end %>
    - <% if can_manage_tags?(@my_module.experiment.project) %> - - <% end %> + <% end %> @@ -55,7 +51,6 @@
    - <% if can_manage_tags?(@my_module.experiment.project) %> <%= bootstrap_form_for [@my_module, @new_mmt], remote: true, format: :json, html: { class: 'add-tag-form' } do |f| %>
    @@ -85,5 +80,4 @@ <% end %> <% end %>
    - <% end %>
    diff --git a/app/views/user_my_modules/_index.html.erb b/app/views/user_my_modules/_index.html.erb index 445caddc1..9afdc53ad 100644 --- a/app/views/user_my_modules/_index.html.erb +++ b/app/views/user_my_modules/_index.html.erb @@ -25,7 +25,7 @@ <% end %> <% end %> -<% if manage_users_in_module?(@my_module) %> +<% if can_manage_users_in_module?(@my_module) %>

    <%= link_to t('experiments.canvas.popups.manage_users'), my_module_users_edit_path(@my_module, format: :json), remote: true, class: "manage-users-link" %> diff --git a/app/views/user_my_modules/_index_edit.html.erb b/app/views/user_my_modules/_index_edit.html.erb index a5b52f19a..013cf51b6 100644 --- a/app/views/user_my_modules/_index_edit.html.erb +++ b/app/views/user_my_modules/_index_edit.html.erb @@ -19,7 +19,7 @@
    - <% if manage_users_in_module?(@my_module) %> + <% if can_manage_users_in_module?(@my_module) %>
    <%= link_to my_module_user_my_module_path(@my_module, umm, format: :json), method: :delete, remote: true, class: 'btn btn-link remove-user-link' do %> @@ -32,7 +32,7 @@ <% end %> <% end %> -<% if manage_users_in_module?(@my_module) && @unassigned_users.count > 0 %> +<% if can_manage_users_in_module?(@my_module) && @unassigned_users.count > 0 %>
  • From fa7710fb809d741f40b51b7f539fa15cad3fe0d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Sun, 4 Mar 2018 15:17:46 +0100 Subject: [PATCH 41/59] Forgot to remove unneeded code form permissions after the previous refactoring. --- app/permissions/experiment.rb | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/app/permissions/experiment.rb b/app/permissions/experiment.rb index a8a0cde7f..fe7e4452c 100644 --- a/app/permissions/experiment.rb +++ b/app/permissions/experiment.rb @@ -136,32 +136,19 @@ Canaid::Permissions.register_for(Protocol) do # protocol in module: read # step in module: read, read comments, read/download assets can :read_protocol_in_module do |user, protocol| - if protocol.in_module? - can_read_experiment?(user, protocol.my_module.experiment) - else - false - end + can_read_experiment?(user, protocol.my_module.experiment) end # protocol in module: create/update/delete, unlink, revert, update from # protocol in repository, update from file # step in module: create/update/delete, reorder can :manage_protocol_in_module do |user, protocol| - if protocol.in_module? - can_manage_module?(user, protocol.my_module) - else - false - end + can_manage_module?(user, protocol.my_module) end # step: complete/uncomplete can :complete_or_checkbox_step do |user, protocol| - if protocol.in_module? - can_complete_module?(user, protocol.my_module) - else - # In repository, user cannot complete steps - false - end + can_complete_module?(user, protocol.my_module) end end From 61d1f5374db398d41b93d863c4eb30b4cd050692 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Sun, 4 Mar 2018 15:24:43 +0100 Subject: [PATCH 42/59] Additionaly removed some unneeded code, related to the previous commit. --- app/controllers/step_comments_controller.rb | 78 ++++++++++----------- 1 file changed, 36 insertions(+), 42 deletions(-) diff --git a/app/controllers/step_comments_controller.rb b/app/controllers/step_comments_controller.rb index 259fbc88a..713592122 100644 --- a/app/controllers/step_comments_controller.rb +++ b/app/controllers/step_comments_controller.rb @@ -51,21 +51,19 @@ class StepCommentsController < ApplicationController step_comment_annotation_notification # Generate activity (this can only occur in module, # but nonetheless check if my module is not nil) - if @protocol.in_module? - Activity.create( - type_of: :add_comment_to_step, - user: current_user, - project: @step.my_module.experiment.project, - experiment: @step.my_module.experiment, - my_module: @step.my_module, - message: t( - "activities.add_comment_to_step", - user: current_user.full_name, - step: @step.position + 1, - step_name: @step.name - ) + Activity.create( + type_of: :add_comment_to_step, + user: current_user, + project: @step.my_module.experiment.project, + experiment: @step.my_module.experiment, + my_module: @step.my_module, + message: t( + "activities.add_comment_to_step", + user: current_user.full_name, + step: @step.position + 1, + step_name: @step.name ) - end + ) format.json { render json: { @@ -112,21 +110,19 @@ class StepCommentsController < ApplicationController step_comment_annotation_notification(old_text) # Generate activity - if @protocol.in_module? - Activity.create( - type_of: :edit_step_comment, - user: current_user, - project: @step.my_module.experiment.project, - experiment: @step.my_module.experiment, - my_module: @step.my_module, - message: t( - 'activities.edit_step_comment', - user: current_user.full_name, - step: @step.position + 1, - step_name: @step.name - ) + Activity.create( + type_of: :edit_step_comment, + user: current_user, + project: @step.my_module.experiment.project, + experiment: @step.my_module.experiment, + my_module: @step.my_module, + message: t( + 'activities.edit_step_comment', + user: current_user.full_name, + step: @step.position + 1, + step_name: @step.name ) - end + ) message = custom_auto_link(@comment.message) render json: { comment: message }, status: :ok else @@ -142,21 +138,19 @@ class StepCommentsController < ApplicationController format.json do if @comment.destroy # Generate activity - if @protocol.in_module? - Activity.create( - type_of: :delete_step_comment, - user: current_user, - project: @step.my_module.experiment.project, - experiment: @step.my_module.experiment, - my_module: @step.my_module, - message: t( - 'activities.delete_step_comment', - user: current_user.full_name, - step: @step.position + 1, - step_name: @step.name - ) + Activity.create( + type_of: :delete_step_comment, + user: current_user, + project: @step.my_module.experiment.project, + experiment: @step.my_module.experiment, + my_module: @step.my_module, + message: t( + 'activities.delete_step_comment', + user: current_user.full_name, + step: @step.position + 1, + step_name: @step.name ) - end + ) render json: {}, status: :ok else render json: { message: I18n.t('comments.delete_error') }, From a19b672a83fa28dd8916335fef00e28f7dfe9e9b Mon Sep 17 00:00:00 2001 From: mlorb Date: Mon, 5 Mar 2018 13:12:44 +0100 Subject: [PATCH 43/59] change validation again --- app/controllers/users/registrations_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/users/registrations_controller.rb b/app/controllers/users/registrations_controller.rb index b942a93ac..9adfc5e6c 100644 --- a/app/controllers/users/registrations_controller.rb +++ b/app/controllers/users/registrations_controller.rb @@ -182,7 +182,7 @@ class Users::RegistrationsController < Devise::RegistrationsController # Create new team for the new user @team = Team.new(team_provider_params) - if @team.valid? && @user.present? && Rails.configuration.x.new_team_on_signup + if @team.valid? && @user && Rails.configuration.x.new_team_on_signup # Set the confirmed_at == created_at IF not using email confirmations unless Rails.configuration.x.enable_email_confirmations @user.update!(confirmed_at: @user.created_at) From 554b31e0aa0be625d48216ff13c34ccc1793d39d Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Mon, 5 Mar 2018 16:09:06 +0100 Subject: [PATCH 44/59] Added constants --- app/helpers/protocols_io_helper.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index adf33971c..069f313aa 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -39,6 +39,11 @@ module ProtocolsIoHelper I18n.t('protocols.protocols_io_import.too_long').length # The + 2 above (in title) is there because if the length was at the limit, # the cutter method had issues, this gives it some space + + # below are default min table settings (minimum 5x5) + PIO_TABLE_MIN_WIDTH = 5 + PIO_TABLE_MIN_HEIGHT = 5 + def protocolsio_string_to_table_element(description_string) string_without_tables = string_html_table_remove(description_string) table_regex = %r{]*>(.*?)<\/table>}m @@ -51,7 +56,7 @@ module ProtocolsIoHelper table_strings.each_with_index do |table, table_counter| tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count - diff = 5 - tr_number # always tables have atleast 5 rows + diff = PIO_TABLE_MIN_HEIGHT - tr_number # always tables have atleast 5 row table_fix_str = tr_number > 4 ? table[0] : table[0] + '' * diff tr_strings = table_fix_str.scan(tr_regex) contents = {} @@ -60,7 +65,7 @@ module ProtocolsIoHelper td_strings = tr[0].scan(td_regex) contents['data'][tr_counter] = [] td_counter = td_strings.count - diff = 5 - td_counter + diff = PIO_TABLE_MIN_WIDTH - td_counter td_strings.each do |td| td_stripped = ActionController::Base.helpers.strip_tags(td[0]) contents['data'][tr_counter].push(td_stripped) From e3e7514049b1ee8c55d7b875a89874307e794be4 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Mon, 5 Mar 2018 16:15:33 +0100 Subject: [PATCH 45/59] removed redundant return --- app/helpers/protocols_io_helper.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index b1437bec1..9a62c264c 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -151,8 +151,7 @@ module ProtocolsIoHelper end def step_hash_null?(step_json) - return true if step_json.dig(0, 'components', 0, 'component_type_id').nil? - false + step_json.dig(0, 'components', 0, 'component_type_id').nil? end # Images are allowed in: From 451d14c2e91737cc8c49048c606d386e31e9326a Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Mon, 5 Mar 2018 16:48:18 +0100 Subject: [PATCH 46/59] Added 4 to constants too, then fixed line too long error --- app/helpers/protocols_io_helper.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index 069f313aa..769d09210 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -57,7 +57,12 @@ module ProtocolsIoHelper tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count diff = PIO_TABLE_MIN_HEIGHT - tr_number # always tables have atleast 5 row - table_fix_str = tr_number > 4 ? table[0] : table[0] + '' * diff + table_fix_str = + if tr_number >= PIO_TABLE_MIN_HEIGHT + table[0] + else + table[0] + '' * diff + end tr_strings = table_fix_str.scan(tr_regex) contents = {} contents['data'] = [] From 1e6f1acef57015e385d78f229d1268077ff87997 Mon Sep 17 00:00:00 2001 From: Zanz2 Date: Mon, 5 Mar 2018 17:02:37 +0100 Subject: [PATCH 47/59] fixed according to pr --- app/helpers/protocols_io_helper.rb | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/app/helpers/protocols_io_helper.rb b/app/helpers/protocols_io_helper.rb index 769d09210..e1b161ba4 100644 --- a/app/helpers/protocols_io_helper.rb +++ b/app/helpers/protocols_io_helper.rb @@ -57,12 +57,8 @@ module ProtocolsIoHelper tables[table_counter.to_s] = {} tr_number = table[0].scan(tr_regex).count diff = PIO_TABLE_MIN_HEIGHT - tr_number # always tables have atleast 5 row - table_fix_str = - if tr_number >= PIO_TABLE_MIN_HEIGHT - table[0] - else - table[0] + '' * diff - end + table_fix_str = table[0] + table_fix_str += '' * diff if tr_number < PIO_TABLE_MIN_HEIGHT tr_strings = table_fix_str.scan(tr_regex) contents = {} contents['data'] = [] @@ -75,7 +71,7 @@ module ProtocolsIoHelper td_stripped = ActionController::Base.helpers.strip_tags(td[0]) contents['data'][tr_counter].push(td_stripped) end - next if td_counter >= 5 + next if td_counter >= PIO_TABLE_MIN_WIDTH diff.times { contents['data'][tr_counter].push(' ') } end tables[table_counter.to_s]['contents'] = Base64.encode64( From c5b0a6525b8965149d5b590eccb397136f84648e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Zrim=C5=A1ek?= Date: Tue, 6 Mar 2018 06:56:35 +0100 Subject: [PATCH 48/59] Some additional permission calls fixes, minor refactoring. --- app/controllers/assets_controller.rb | 2 +- app/controllers/my_modules_controller.rb | 8 +------- app/controllers/wopi_controller.rb | 2 +- app/views/results/_result_asset.html.erb | 2 +- 4 files changed, 4 insertions(+), 10 deletions(-) diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb index 2e44a88be..47496b8b7 100644 --- a/app/controllers/assets_controller.rb +++ b/app/controllers/assets_controller.rb @@ -118,7 +118,7 @@ class AssetsController < ApplicationController render_403 && return unless can_read_protocol_in_module?(@protocol) || can_read_protocol_in_repository?(@protocol) elsif @assoc.class == Result - render_403 and return unless can_view_experiment?(@my_module.experiment) + render_403 and return unless can_read_experiment?(@my_module.experiment) end end diff --git a/app/controllers/my_modules_controller.rb b/app/controllers/my_modules_controller.rb index 60456651e..ee61e7483 100644 --- a/app/controllers/my_modules_controller.rb +++ b/app/controllers/my_modules_controller.rb @@ -6,13 +6,7 @@ class MyModulesController < ApplicationController include ActionView::Helpers::UrlHelper include ApplicationHelper - before_action :load_vars, - only: %I[show update destroy description due_date protocols - results samples activities activities_tab - assign_samples unassign_samples delete_samples - toggle_task_state samples_index archive - complete_my_module repository repository_index - assign_repository_records unassign_repository_records] + before_action :load_vars before_action :load_vars_nested, only: %I[new create] before_action :load_repository, only: %I[assign_repository_records unassign_repository_records] diff --git a/app/controllers/wopi_controller.rb b/app/controllers/wopi_controller.rb index db188e112..53762849d 100644 --- a/app/controllers/wopi_controller.rb +++ b/app/controllers/wopi_controller.rb @@ -305,7 +305,7 @@ class WopiController < ActionController::Base end @breadcrumb_folder_url = @close_url else - @can_read = can_view_experiment?(@my_module.experiment) + @can_read = can_read_experiment?(@my_module.experiment) @can_write = can_manage_module?(@my_module) @close_url = results_my_module_url(@my_module, diff --git a/app/views/results/_result_asset.html.erb b/app/views/results/_result_asset.html.erb index bda38be36..cb7e5d9b4 100644 --- a/app/views/results/_result_asset.html.erb +++ b/app/views/results/_result_asset.html.erb @@ -1,4 +1,4 @@ -<% if can_view_experiment?(result.my_module.experiment) %> +<% if can_read_experiment?(result.my_module.experiment) %> <% if result.asset.file.processing? %> From ca6685806361dc69ab95577756bc95230606a41d Mon Sep 17 00:00:00 2001 From: Oleksii Kriuchykhin Date: Tue, 6 Mar 2018 15:49:30 +0100 Subject: [PATCH 49/59] Fix edit project's users modal [SCI-2130] --- app/views/projects/index.html.erb | 50 +++++++++++++++---------------- 1 file changed, 24 insertions(+), 26 deletions(-) diff --git a/app/views/projects/index.html.erb b/app/views/projects/index.html.erb index 010c6aee4..d6eae5032 100644 --- a/app/views/projects/index.html.erb +++ b/app/views/projects/index.html.erb @@ -23,39 +23,37 @@
    <% end %> -<% if can_manage_project?(@project) %> - -