admin_data 1.0.22 → 1.1.0

data/app/controllers/admin_data/public_controller.rb

@@ -1,27 +1,37 @@
+module AdminData
+  class PublicController < ApplicationController
 
-class AdminData::PublicController < AdminData::BaseController
+    def serve
 
-  def serve
-    f = File.join(AdminData::Config.setting[:plugin_dir], 'lib', params[:file])
+      # validate filename with a white list
+      unless self.class.admin_data_assets.include? params[:file]
+        render :nothing => true, :status => 404 and return
+      end
 
-    unless File.exists?(f)
-      render :nothing => true, :status => 404 and return
+      opts = {:text => File.read(File.join(AdminData.public_dir,params[:file])), :cache => true}
+
+      case params[:file]
+      when /\.css$/i then opts[:content_type] = "text/css"
+      when /\.js$/i then opts[:content_type] = "text/javascript"
+      when /\.png$/i then opts[:content_type] = "image/png"
+      else
+        render :nothing => true, :status => 404 and return
+      end
+
+      render opts
     end
 
-    opts = {:text => File.new(f).read, :cache => true}
-    if f =~ /css$/ 
-      opts[:content_type] = "text/css"
-    elsif f =~ /js$/
-      opts[:content_type] = "text/javascript"
-    else
-      # this is needed so that a user is not able to get data by performing url like
-      # http://localhost:3000/admin_data/public/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
-      # Above url will try to get /etc/passwd
-      # 
-      # ensures that request file must end with js or css
-      render :nothing => true, :status => 404 and return
+    protected
+
+    # Cached list of all assets provided by admin_data
+    # It is used to ensure security in the serve method
+    def self.admin_data_assets
+      @admin_data_assets ||= (
+        Dir.glob(File.join(AdminData.public_dir,'**','*')).map do |path|
+           # we want only relative paths
+           path = path.split(AdminData.public_dir,2).last
+        end
+      )
     end
-    render opts
   end
-
 end

data/app/controllers/admin_data/search_controller.rb

@@ -1,125 +1,121 @@
-require File.join(File.dirname(__FILE__) , '..', '..', '..', 'lib', 'admin_data', 'search')
-
-class AdminData::SearchController < AdminData::BaseController
-
-  include Search
-
-  unloadable
-
-  before_filter :get_class_from_params
-  before_filter :ensure_is_allowed_to_view
-  before_filter :ensure_is_allowed_to_view_klass
-  before_filter :ensure_valid_children_klass, :only => [:quick_search]
-  before_filter :ensure_is_authorized_for_update_opration, :only => [:advance_search]
-  before_filter :set_column_type_info, :only => [:advance_search]
-
-  def quick_search
-    @page_title = "Search #{@klass.name.underscore}"
-    @order = default_order
-
-    if params[:base]
-      klass = AdminData::Util.camelize_constantize(params[:base])
-      model = klass.find(params[:model_id])
-      has_many_proxy = model.send(params[:children].intern)
-      @total_num_of_children = has_many_proxy.send(:count)
-      h = { :page => params[:page], :per_page => per_page, :order => @order }
-      @records = has_many_proxy.send(:paginate, h)
-    else
-      params[:query] = params[:query].strip unless params[:query].blank?
-      cond = build_quick_search_conditions(@klass, params[:query])
-      h = { :page => params[:page], :per_page => per_page, :order => @order, :conditions => cond }
-      @records = @klass.unscoped.paginate(h)
+require File.join(AdminData::LIBPATH, 'admin_data', 'search')
+
+module AdminData
+  class SearchController < ApplicationController
+
+    include Search
+
+    before_filter :get_class_from_params
+    before_filter :ensure_valid_children_klass, :only => [:quick_search]
+    before_filter :ensure_is_authorized_for_update_opration, :only => [:advance_search]
+    before_filter :set_column_type_info, :only => [:advance_search]
+
+    def quick_search
+      @page_title = "Search #{@klass.name.underscore}"
+      @order = default_order
+
+      if params[:base]
+        klass = Util.camelize_constantize(params[:base])
+        model = klass.find(params[:model_id])
+        has_many_proxy = model.send(params[:children].intern)
+        @total_num_of_children = has_many_proxy.send(:count)
+        h = { :page => params[:page], :per_page => per_page, :order => @order }
+        @records = has_many_proxy.send(:paginate, h)
+      else
+        params[:query] = params[:query].strip unless params[:query].blank?
+        cond = build_quick_search_conditions(@klass, params[:query])
+        h = { :page => params[:page], :per_page => per_page, :order => @order, :conditions => cond }
+        @records = @klass.unscoped.paginate(h)
+      end
+      respond_to {|format| format.html}
     end
-    respond_to {|format| format.html}
-  end
 
 
-  def advance_search
-    @page_title = "Advance search #{@klass.name.underscore}"
-    plugin_dir = AdminData::Config.setting[:plugin_dir]
-    hash = build_advance_search_conditions(@klass, params[:adv_search])
-    @relation = hash[:cond]
-    errors = hash[:errors]
-    @order = default_order
+    def advance_search
+      @page_title = "Advance search #{@klass.name.underscore}"
+      hash = build_advance_search_conditions(@klass, params[:adv_search])
+      @relation = hash[:cond]
+      errors = hash[:errors]
+      @order = default_order
+
+      respond_to do |format|
+        format.html { render }
+        format.js {
+
+          unless hash[:errors].blank?
+            file = "#{AdminData.plugin_dir}app/views/admin_data/search/search/_errors.html.erb"
+            render :file =>  file, :locals => {:errors => errors}
+            return
+          end
+          if params[:admin_data_advance_search_action_type] == 'destroy'
+            handle_advance_search_action_type_destroy
+          elsif params[:admin_data_advance_search_action_type] == 'delete'
+            handle_advance_search_action_type_delete
+          else
+            @records = @relation.order(@order).paginate(:page => params[:page], :per_page => per_page)
+          end
+
+          if @success_message
+            render :json => {:success => @success_message }
+          else
+            file = "/admin_data/search/search/listing.html.erb"
+            render :partial => file, :locals => {:klass => @klass}, :layout => false
+          end
+        }
+      end
+    end
 
-    respond_to do |format|
-      format.html { render }
-      format.js {
+    private
 
-        unless hash[:errors].blank?
-          file = "#{plugin_dir}/app/views/admin_data/search/search/_errors.html.erb"
-          render :file =>  file, :locals => {:errors => errors}
+    def ensure_valid_children_klass
+      if params[:base]
+        begin
+          model_klass = Util.camelize_constantize(params[:base])
+        rescue NameError => e #incase params[:base] is junk value
+          render :text => "#{params[:base]} is an invalid value", :status => :not_found
           return
         end
-        if params[:admin_data_advance_search_action_type] == 'destroy'
-          handle_advance_search_action_type_destroy
-        elsif params[:admin_data_advance_search_action_type] == 'delete'
-          handle_advance_search_action_type_delete
+        if ActiveRecordUtil.declared_has_many_association_names(model_klass).include?(params[:children]) || ActiveRecordUtil.declared_habtm_association_names(model_klass).include?(params[:children])
+          #proceed
         else
-          @records = @relation.order(@order).paginate(:page => params[:page], :per_page => per_page)
-        end
-
-        if @success_message
-          render :json => {:success => @success_message }
-        else
-          file = "/admin_data/search/search/listing.html.erb"
-          render :partial => file, :locals => {:klass => @klass}, :layout => false
+          render :text => "#{params[:children]} is not a valid has_many association", :status => :not_found
+          return
         end
-      }
+      end
     end
-  end
 
-  private
-
-  def ensure_valid_children_klass
-    if params[:base]
-      begin
-        model_klass = AdminData::Util.camelize_constantize(params[:base])
-      rescue NameError => e #incase params[:base] is junk value
-        render :text => "#{params[:base]} is an invalid value", :status => :not_found
-        return
-      end
-      #TODO write test for this condition
-      if AdminData::ActiveRecordUtil.declared_has_many_association_names(model_klass).include?(params[:children]) || AdminData::ActiveRecordUtil.declared_habtm_association_names(model_klass).include?(params[:children])
-        #proceed
-      else
-        render :text => "#{params[:children]} is not a valid has_many association", :status => :not_found
-        return
+    def ensure_is_authorized_for_update_opration
+      if %w(destroy delete).include? params[:admin_data_advance_search_action_type]
+        render :text => 'not authorized' unless is_allowed_to_update?
       end
     end
-  end
 
-  def ensure_is_authorized_for_update_opration
-    if %w(destroy delete).include? params[:admin_data_advance_search_action_type]
-      render :text => 'not authorized' unless admin_data_is_allowed_to_update?
+    def handle_advance_search_action_type_delete
+      count = @relation.count
+      @relation.delete_all
+      @success_message = "#{count} #{Util.pluralize(count, 'record')} deleted"
     end
-  end
 
-  def handle_advance_search_action_type_delete
-    count = @relation.count
-    @relation.delete_all
-    @success_message = "#{count} #{AdminData::Util.pluralize(count, 'record')} deleted"
-  end
+    def handle_advance_search_action_type_destroy
+      count = @relation.count
+      @relation.find_in_batches do |group|
+        group.each {|record| record.destroy }
+      end
+      @success_message = "#{count} #{Util.pluralize(count, 'record')} destroyed"
+    end
 
-  def handle_advance_search_action_type_destroy
-    count = @relation.count
-    @relation.find_in_batches do |group|
-      group.each {|record| record.destroy }
+    def default_order
+      params[:sortby] || "#{@klass.send(:table_name)}.#{@klass.send(:primary_key)} desc"
     end
-    @success_message = "#{count} #{AdminData::Util.pluralize(count, 'record')} destroyed"
-  end
 
-  def default_order
-    params[:sortby] || "#{@klass.send(:table_name)}.#{@klass.send(:primary_key)} desc"
-  end
+    def set_column_type_info
+      column_type_info = @klass.columns.collect { |column|
+        #JSLint complains if a hash has key named boolean. So I am changing the key to booleant
+        column_type =  (column.type.to_s == 'boolean') ? 'booleant' : column.type.to_s
+        %Q{ "#{column.name}":"#{column_type}" }
+      }.join(',')
+      @column_type_info = "{#{column_type_info}}"
+    end
 
-  def set_column_type_info
-    column_type_info = @klass.columns.collect { |column|
-      #JSLint complains if a hash has key named boolean. So I am changing the key to booleant
-      column_type =  (column.type.to_s == 'boolean') ? 'booleant' : column.type.to_s
-      %Q{ "#{column.name}":"#{column_type}" }
-    }.join(',')
-    @column_type_info = "{#{column_type_info}}"
   end
-
 end

data/app/controllers/admin_data/table_structure_controller.rb

@@ -0,0 +1,25 @@
+module AdminData
+  class TableStructureController < ApplicationController
+
+    before_filter :get_class_from_params
+
+    def index
+      @page_title = 'table_structure'
+      @indexes = []
+      if (indexes = ActiveRecord::Base.connection.indexes(@klass.table_name)).any?
+        add_index_statements = indexes.map do |index|
+          statment_parts = [ ('add_index ' + index.table.inspect) ]
+          statment_parts << index.columns.inspect
+          statment_parts << (':name => ' + index.name.inspect)
+          statment_parts << ':unique => true' if index.unique
+
+          '  ' + statment_parts.join(', ')
+        end
+        add_index_statements.sort.each { |index| @indexes << index }
+      end
+      respond_to {|format| format.html}
+    end
+
+  end
+end
+

data/app/helpers/admin_data/application_helper.rb

@@ -0,0 +1,287 @@
+module AdminData
+  module ApplicationHelper
+
+    def column_title(klass, column)
+      AdminData.config.column_headers[klass.name].try(:fetch,column.intern, nil) || column
+    end
+
+    # AdminData.config.columns_order might not list all the columns of a given table. However
+    # the listed columns should be at the front in the order mentioned. Primary key will also
+    # be the first column. Consumer might define a new column name that is not listed a column.
+    #
+    def columns_order(klass)
+      columns_symbol = klass.columns.map {|e| e.name.intern}
+
+      # created_at and updated_at should be at the very end by default
+      if columns_symbol.include? :created_at
+        columns_symbol = (columns_symbol - [:created_at]) + [:created_at]
+      end
+      if columns_symbol.include? :updated_at
+        columns_symbol = (columns_symbol - [:updated_at]) + [:updated_at]
+      end
+
+      if requested_order = AdminData.config.columns_order[klass.name]
+        primary_key = klass.send(:primary_key).intern
+        order = [primary_key] + requested_order
+        order.uniq!
+        # add the columns not covered by user at the end of the list
+        sorted_columns = order + (columns_symbol - order)
+        sorted_columns.map(&:to_s)
+      else
+        columns_symbol.map(&:to_s)
+      end
+    end
+
+    def total_records_info(klass)
+      '(Total ' + pluralize(klass.count, 'record') + ' )'
+    end
+
+    def search_result_title(total_num_of_children, records)
+      output = []
+      if params[:base]
+        label = params[:base].camelize + ' ID ' + params[:model_id]
+        output << link_to(label, admin_data_path(:klass => params[:base], :id => params[:model_id]))
+        output << 'has'
+        output << pluralize(total_num_of_children, params[:klass])
+
+      elsif !params[:query].blank? || params[:adv_search]
+        output << 'Search result:'
+        output << pluralize(records.total_entries, 'record')
+        output << 'found'
+
+      else
+        output << 'All '
+        output << params[:klass].camelize
+        output << 'records'
+      end
+      output.join(' ').html_safe
+    end
+
+    def column_native(klass, column)
+      klass.send(:columns).select {|r| r.instance_variable_get('@name') == column}.first || column
+    end
+
+    def has_one(model, klass)
+      tmp = AdminData::ActiveRecordUtil.declared_has_one_association_names(klass)
+      tmp.inject('') do |output, ho|
+        begin
+          label = ho
+          if model.send(ho)
+            output << link_to(label, admin_data_path(:klass => ho.underscore, :id => model.send(ho)))
+          else
+            output << label
+          end
+        rescue => e
+          Rails.logger.debug AdminData::Util.exception_info(e)
+        end
+        output
+      end
+    end
+
+    def has_many_data(model, klass)
+      array = AdminData::ActiveRecordUtil.declared_has_many_association_names(klass).map do |m|
+        begin
+          count = model.send(m.intern).count
+          label = m.to_s + '(' + count.to_s + ')'
+          output = label
+          if count > 0
+            has_many_klass_name = AdminData::ActiveRecordUtil.klass_for_association_type_and_name(model.class, :has_many, m).name.underscore
+            output = link_to(label, admin_data_search_path(  :klass => has_many_klass_name,
+            :children => m,
+            :base => klass.name.underscore,
+            :model_id => model.id))
+          end
+        rescue => e
+          Rails.logger.debug AdminData::Util.exception_info(e)
+        end
+        output
+      end
+      array.join(', ')
+    end
+
+    def belongs_to_data(model, klass)
+      AdminData::ActiveRecordUtil.declared_belongs_to_association_names(klass).map do |assoc_name|
+        begin
+          output = assoc_name
+          if belongs_to_record = model.send(assoc_name)
+            output = link_to(assoc_name, admin_data_path(:klass => belongs_to_record.class.name.underscore, :id => belongs_to_record.id))
+          end
+        rescue => e
+          Rails.logger.info AdminData::Util.exception_info(e)
+        end
+        output
+      end.join(', ')
+    end
+
+    def habtm_data(model, klass)
+      AdminData::ActiveRecordUtil.declared_habtm_association_names(klass).map do |assoc_name|
+        begin
+          count = model.send(assoc_name.intern).count
+          label = assoc_name + '(' + count.to_s + ')'
+          output = label
+
+          if count > 0 then
+            has_many_klass_name = AdminData::ActiveRecordUtil.klass_for_association_type_and_name(model.class, :has_and_belongs_to_many, assoc_name).name.underscore
+            output = link_to(label, admin_data_search_path(  :klass => has_many_klass_name,
+            :children => assoc_name,
+            :base => klass.name.underscore,
+            :model_id => model.id))
+          end
+        rescue => e
+          Rails.logger.info AdminData::Util.exception_info(e)
+        end
+        output
+      end.join(', ')
+    end
+
+    def breadcrum(&block)
+      render(:partial => '/admin_data/shared/breadcrum', :locals => {:data => capture(&block)})
+    end
+
+    def form_field(klass, model, col, f)
+      html = []
+      column_value = model.send(col.name)
+
+      if klass.serialized_attributes.has_key?(col.name)
+        return AdminData::Util.get_serialized_value(html,column_value)
+      end
+
+      if col.primary
+        html <<  model.new_record? ? '(auto)' : model.id
+      elsif get_reflection_for_column(klass, col) && AdminData.config.drop_down_for_associations[klass.name]
+        form_field_for_association_records(klass, col, f, html)
+      else
+        handle_column_type(col, html, model, column_value, f)
+      end
+    end
+
+
+    def form_field_for_association_records(klass, col, f, html)
+      begin
+        reflection = get_reflection_for_column(klass, col)
+
+        # in some edge cases following code throws exception. investigating ..
+        options = reflection.options
+        if options.keys.include?(:polymorphic) && options.fetch(:polymorphic)
+          build_text_field(html, f, col)
+        else
+          ref_klass = reflection.klass
+          association_name = ref_klass.columns.map(&:name).include?('name') ? :name : ref_klass.primary_key
+          all_for_dropdown = ref_klass.all(:order => "#{association_name} asc")
+          html << f.collection_select(col.name, all_for_dropdown, :id, association_name, :include_blank => true)
+        end
+        html.join
+      rescue Exception => e
+        Rails.logger.info AdminData::Util.exception_info(e)
+        'could not retrieve' # returning nil
+      end
+    end
+
+    def form_field_for_habtm_records(klass, model, f, html)
+      begin
+        html = []
+        AdminData::ActiveRecordUtil.delcared_habtm_association_names(klass).each do |k|
+          assoc_klass = AdminData::Util.get_class_name_for_habtm_association(model, k)
+
+          html << "<div class='col_box'>"
+          html << "  <span class='col_name'>#{assoc_klass.table_name}</span>"
+          html << "  <span class='col_type'>[integer]</span>"
+          html << "</div>"
+
+          order_by = assoc_klass.columns.map(&:name).include?('name') ? :name : assoc_klass.primary_key
+          all = assoc_klass.all(:order => order_by)
+          selected = model.send(assoc_klass.table_name).map{|e| e.id}
+          html << f.collection_select(assoc_klass.table_name, all, :id, order_by,
+          {:include_blank => false, :selected => selected},
+          {:multiple => true, :size => (all.count > 10 ? 8 : 4)})
+        end
+        html.join
+      rescue Exception => e
+        Rails.logger.info AdminData::Util.exception_info(e)
+        'could not retrieve' # returning nil
+      end
+    end
+
+    def handle_column_type(col, html, model, column_value, f)
+      case col.type
+      when :text
+        html << f.text_area(col.name, :rows => 6, :cols => 70)
+
+      when :datetime
+        if ['created_at', 'updated_at'].include?(col.name)
+          html <<  '(auto)'
+        else
+          value = params[:action] == 'new' ? Time.now : column_value
+          year_value = value.year if value
+          datetime_selects = f.datetime_select(col.name, :include_blank => true)
+          html << datetime_selects.gsub('type="hidden"', 'type="text" size="4" class="nice-field"')
+        end
+
+      when :date
+        value = params[:action] == 'new' ? Time.now : column_value
+        year_value = value.year if value
+        date_selects = f.date_select(col.name, :discard_year => true, :include_blank => true)
+        html << date_selects.gsub('type="hidden"', 'type="text" size="4" class="nice-field"')
+
+      when :time
+        # time_select method of rails is buggy and is causing problem
+        # 1 error(s) on assignment of multiparameter attributes
+        #
+        # will try again this method with Rails 3
+        #html << f.time_select(col.name, :include_blank => true, :include_seconds => true)
+
+      when :boolean
+        html << f.select(col.name, [['True', true], ['False', false]], :include_blank => true)
+
+      else
+        build_text_field(html, f, col)
+      end
+      html.join
+    end
+
+
+    def build_text_field(html, f, col)
+      options = {:class => 'nice-field'}
+      if AdminData.config.ignore_column_limit
+        options[:size] = 60
+        options[:maxlength] = 255
+      else
+        options[:size] = (col && col.limit && col.limit < 60) ? col.limit : 60
+        options[:maxlength] = col.limit if col.limit
+      end
+      html << f.text_field(col.name, options)
+      html.join
+    end
+
+    # uses truncate method
+    # options supports :limit which is applied if the column type is string or text.
+    # calls the inspect method to convert to a string if the column is serialized.
+    # TODO rspec test limit option
+    def get_value_for_column(column, model, options = {})
+      options.reverse_merge!(:limit => 400)
+
+      value = AdminData::Util.custom_value_for_column(column, model)
+
+      if column.is_a?(String)
+        value
+      elsif column.type == :datetime
+        value.strftime('%d-%B-%Y %H:%M:%S %p') unless value.blank?
+      elsif column.type == :string || column.type == :text
+        value = value.inspect if model.class.serialized_attributes.keys.include?(column.name)
+        return value if options[:limit].blank?
+        begin
+          truncate(value,:length => options[:limit])
+        rescue # truncate method failed
+          '<actual data is not being shown because truncate method failed.>'
+        end
+      else
+        value.to_s
+      end
+    end
+
+    def get_reflection_for_column(klass, col)
+      klass.reflections.values.detect { |reflection| reflection.primary_key_name.to_sym == col.name.to_sym }
+    end
+
+  end
+end