blazer 2.2.6

data/app/controllers/blazer/base_controller.rb

@@ -0,0 +1,124 @@
+module Blazer
+  class BaseController < ApplicationController
+    # skip filters
+    filters = _process_action_callbacks.map(&:filter) - [:activate_authlogic]
+    skip_before_action(*filters, raise: false)
+    skip_after_action(*filters, raise: false)
+    skip_around_action(*filters, raise: false)
+
+    protect_from_forgery with: :exception
+
+    if ENV["BLAZER_PASSWORD"]
+      http_basic_authenticate_with name: ENV["BLAZER_USERNAME"], password: ENV["BLAZER_PASSWORD"]
+    end
+
+    if Blazer.settings["before_action"]
+      raise Blazer::Error, "The docs for protecting Blazer with a custom before_action had an incorrect example from August 2017 to June 2018. The example method had a boolean return value. However, you must render or redirect if a user is unauthorized rather than return a falsy value. Double check that your before_action works correctly for unauthorized users (if it worked when added, there should be no issue). Then, change before_action to before_action_method in config/blazer.yml."
+    end
+
+    if Blazer.before_action
+      before_action Blazer.before_action.to_sym
+    end
+
+    if Blazer.override_csp
+      after_action do
+        response.headers['Content-Security-Policy'] = "default-src 'self' https: 'unsafe-inline' 'unsafe-eval' data:"
+      end
+    end
+
+    layout "blazer/application"
+
+    private
+
+      def process_vars(statement, data_source)
+        (@bind_vars ||= []).concat(Blazer.extract_vars(statement)).uniq!
+        @bind_vars.each do |var|
+          params[var] ||= Blazer.data_sources[data_source].variable_defaults[var]
+        end
+        @success = @bind_vars.all? { |v| params[v] }
+
+        if @success
+          @bind_vars.each do |var|
+            value = params[var].presence
+            if value
+              if ["start_time", "end_time"].include?(var)
+                value = value.to_s.gsub(" ", "+") # fix for Quip bug
+              end
+
+              if var.end_with?("_at")
+                begin
+                  value = Blazer.time_zone.parse(value)
+                rescue
+                  # do nothing
+                end
+              end
+
+              if value =~ /\A\d+\z/
+                value = value.to_i
+              elsif value =~ /\A\d+\.\d+\z/
+                value = value.to_f
+              end
+            end
+            value = Blazer.transform_variable.call(var, value) if Blazer.transform_variable
+            statement.gsub!("{#{var}}", ActiveRecord::Base.connection.quote(value))
+          end
+        end
+      end
+
+      def parse_smart_variables(var, data_source)
+        smart_var_data_source =
+          ([data_source] + Array(data_source.settings["inherit_smart_settings"]).map { |ds| Blazer.data_sources[ds] }).find { |ds| ds.smart_variables[var] }
+
+        if smart_var_data_source
+          query = smart_var_data_source.smart_variables[var]
+
+          if query.is_a? Hash
+            smart_var = query.map { |k,v| [v, k] }
+          elsif query.is_a? Array
+            smart_var = query.map { |v| [v, v] }
+          elsif query
+            result = smart_var_data_source.run_statement(query)
+            smart_var = result.rows.map { |v| v.reverse }
+            error = result.error if result.error
+          end
+        end
+
+        [smart_var, error]
+      end
+
+      # don't pass to url helpers
+      #
+      # some are dangerous when passed as symbols
+      # root_url({host: "evilsite.com"})
+      #
+      # certain ones (like host) only affect *_url and not *_path
+      #
+      # when permitted parameters are passed in Rails 6,
+      # they appear to be added as GET parameters
+      # root_url(params.permit(:host))
+      BLACKLISTED_KEYS = [:controller, :action, :id, :host, :query, :dashboard, :query_id, :query_ids, :table_names, :authenticity_token, :utf8, :_method, :commit, :statement, :data_source, :name, :fork_query_id, :blazer, :run_id, :script_name, :original_script_name]
+
+      # remove blacklisted keys from both params and permitted keys for better sleep
+      def variable_params(resource)
+        permitted_keys = resource.variables - BLACKLISTED_KEYS.map(&:to_s)
+        params.except(*BLACKLISTED_KEYS).permit(*permitted_keys)
+      end
+      helper_method :variable_params
+
+      def blazer_user
+        send(Blazer.user_method) if Blazer.user_method && respond_to?(Blazer.user_method, true)
+      end
+      helper_method :blazer_user
+
+      def render_errors(resource)
+        @errors = resource.errors
+        action = resource.persisted? ? :edit : :new
+        render action, status: :unprocessable_entity
+      end
+
+      # do not inherit from ApplicationController - #120
+      def default_url_options
+        {}
+      end
+  end
+end

data/app/controllers/blazer/checks_controller.rb

@@ -0,0 +1,56 @@
+module Blazer
+  class ChecksController < BaseController
+    before_action :set_check, only: [:edit, :update, :destroy, :run]
+
+    def index
+      state_order = [nil, "disabled", "error", "timed out", "failing", "passing"]
+      @checks = Blazer::Check.joins(:query).includes(:query).order("blazer_queries.name, blazer_checks.id").to_a.sort_by { |q| state_order.index(q.state) || 99 }
+      @checks.select! { |c| "#{c.query.name} #{c.emails}".downcase.include?(params[:q]) } if params[:q]
+    end
+
+    def new
+      @check = Blazer::Check.new(query_id: params[:query_id])
+    end
+
+    def create
+      @check = Blazer::Check.new(check_params)
+      # use creator_id instead of creator
+      # since we setup association without checking if column exists
+      @check.creator = blazer_user if @check.respond_to?(:creator_id=) && blazer_user
+
+      if @check.save
+        redirect_to query_path(@check.query)
+      else
+        render_errors @check
+      end
+    end
+
+    def update
+      if @check.update(check_params)
+        redirect_to query_path(@check.query)
+      else
+        render_errors @check
+      end
+    end
+
+    def destroy
+      @check.destroy
+      redirect_to checks_path
+    end
+
+    def run
+      @query = @check.query
+      redirect_to query_path(@query)
+    end
+
+    private
+
+      def check_params
+        params.require(:check).permit(:query_id, :emails, :slack_channels, :invert, :check_type, :schedule)
+      end
+
+      def set_check
+        @check = Blazer::Check.find(params[:id])
+      end
+  end
+end

data/app/controllers/blazer/dashboards_controller.rb

@@ -0,0 +1,101 @@
+module Blazer
+  class DashboardsController < BaseController
+    before_action :set_dashboard, only: [:show, :edit, :update, :destroy, :refresh]
+
+    def new
+      @dashboard = Blazer::Dashboard.new
+    end
+
+    def create
+      @dashboard = Blazer::Dashboard.new
+      # use creator_id instead of creator
+      # since we setup association without checking if column exists
+      @dashboard.creator = blazer_user if @dashboard.respond_to?(:creator_id=) && blazer_user
+
+      if update_dashboard(@dashboard)
+        redirect_to dashboard_path(@dashboard)
+      else
+        render_errors @dashboard
+      end
+    end
+
+    def show
+      @queries = @dashboard.dashboard_queries.order(:position).preload(:query).map(&:query)
+      @queries.each do |query|
+        process_vars(query.statement, query.data_source)
+      end
+      @bind_vars ||= []
+
+      @smart_vars = {}
+      @sql_errors = []
+      @data_sources = @queries.map { |q| Blazer.data_sources[q.data_source] }.uniq
+      @bind_vars.each do |var|
+        @data_sources.each do |data_source|
+          smart_var, error = parse_smart_variables(var, data_source)
+          ((@smart_vars[var] ||= []).concat(smart_var)).uniq! if smart_var
+          @sql_errors << error if error
+        end
+      end
+    end
+
+    def edit
+    end
+
+    def update
+      if update_dashboard(@dashboard)
+        redirect_to dashboard_path(@dashboard, variable_params(@dashboard))
+      else
+        render_errors @dashboard
+      end
+    end
+
+    def destroy
+      @dashboard.destroy
+      redirect_to dashboards_path
+    end
+
+    def refresh
+      @dashboard.queries.each do |query|
+        data_source = Blazer.data_sources[query.data_source]
+        statement = query.statement.dup
+        process_vars(statement, query.data_source)
+        Blazer.transform_statement.call(data_source, statement) if Blazer.transform_statement
+        data_source.clear_cache(statement)
+      end
+      redirect_to dashboard_path(@dashboard, variable_params(@dashboard))
+    end
+
+    private
+
+      def dashboard_params
+        params.require(:dashboard).permit(:name)
+      end
+
+      def set_dashboard
+        @dashboard = Blazer::Dashboard.find(params[:id])
+      end
+
+      def update_dashboard(dashboard)
+        dashboard.assign_attributes(dashboard_params)
+        Blazer::Dashboard.transaction do
+          if params[:query_ids].is_a?(Array)
+            query_ids = params[:query_ids].map(&:to_i)
+            @queries = Blazer::Query.find(query_ids).sort_by { |q| query_ids.index(q.id) }
+          end
+          if dashboard.save
+            if @queries
+              @queries.each_with_index do |query, i|
+                dashboard_query = dashboard.dashboard_queries.where(query_id: query.id).first_or_initialize
+                dashboard_query.position = i
+                dashboard_query.save!
+              end
+              if dashboard.persisted?
+                dashboard.dashboard_queries.where.not(query_id: query_ids).destroy_all
+              end
+            end
+            true
+          end
+        end
+      end
+  end
+end

data/app/controllers/blazer/queries_controller.rb

@@ -0,0 +1,347 @@
+module Blazer
+  class QueriesController < BaseController
+    before_action :set_query, only: [:show, :edit, :update, :destroy, :refresh]
+    before_action :set_data_source, only: [:tables, :docs, :schema, :cancel]
+
+    def home
+      set_queries(1000)
+
+      if params[:filter]
+        @dashboards = [] # TODO show my dashboards
+      else
+        @dashboards = Blazer::Dashboard.order(:name)
+        @dashboards = @dashboards.includes(:creator) if Blazer.user_class
+      end
+
+      @dashboards =
+        @dashboards.map do |d|
+          {
+            id: d.id,
+            name: d.name,
+            creator: blazer_user && d.try(:creator) == blazer_user ? "You" : d.try(:creator).try(Blazer.user_name),
+            to_param: d.to_param,
+            dashboard: true
+          }
+        end
+    end
+
+    def index
+      set_queries
+      render json: @queries
+    end
+
+    def new
+      @query = Blazer::Query.new(
+        data_source: params[:data_source],
+        name: params[:name]
+      )
+      if params[:fork_query_id]
+        @query.statement ||= Blazer::Query.find(params[:fork_query_id]).try(:statement)
+      end
+    end
+
+    def create
+      @query = Blazer::Query.new(query_params)
+      @query.creator = blazer_user if @query.respond_to?(:creator)
+
+      if @query.save
+        redirect_to query_path(@query, variable_params(@query))
+      else
+        render_errors @query
+      end
+    end
+
+    def show
+      @statement = @query.statement.dup
+      process_vars(@statement, @query.data_source)
+
+      @smart_vars = {}
+      @sql_errors = []
+      data_source = Blazer.data_sources[@query.data_source]
+      @bind_vars.each do |var|
+        smart_var, error = parse_smart_variables(var, data_source)
+        @smart_vars[var] = smart_var if smart_var
+        @sql_errors << error if error
+      end
+
+      Blazer.transform_statement.call(data_source, @statement) if Blazer.transform_statement
+    end
+
+    def edit
+    end
+
+    def run
+      @statement = params[:statement]
+      data_source = params[:data_source]
+      process_vars(@statement, data_source)
+      @only_chart = params[:only_chart]
+      @run_id = blazer_params[:run_id]
+      @query = Query.find_by(id: params[:query_id]) if params[:query_id]
+      data_source = @query.data_source if @query && @query.data_source
+      @data_source = Blazer.data_sources[data_source]
+
+      # ensure viewable
+      if !(@query || Query.new(data_source: @data_source.id)).viewable?(blazer_user)
+        render_forbidden
+      elsif @run_id
+        @timestamp = blazer_params[:timestamp].to_i
+
+        @result = @data_source.run_results(@run_id)
+        @success = !@result.nil?
+
+        if @success
+          @data_source.delete_results(@run_id)
+          @columns = @result.columns
+          @rows = @result.rows
+          @error = @result.error
+          @just_cached = !@result.error && @result.cached_at.present?
+          @cached_at = nil
+          params[:data_source] = nil
+          render_run
+        elsif Time.now > Time.at(@timestamp + (@data_source.timeout || 600).to_i + 5)
+          # query lost
+          Rails.logger.info "[blazer lost query] #{@run_id}"
+          @error = "We lost your query :("
+          @rows = []
+          @columns = []
+          render_run
+        else
+          continue_run
+        end
+      elsif @success
+        @run_id = blazer_run_id
+
+        options = {user: blazer_user, query: @query, refresh_cache: params[:check], run_id: @run_id, async: Blazer.async}
+        if Blazer.async && request.format.symbol != :csv
+          Blazer::RunStatementJob.perform_later(@data_source.id, @statement, options)
+          wait_start = Time.now
+          loop do
+            sleep(0.1)
+            @result = @data_source.run_results(@run_id)
+            break if @result || Time.now - wait_start > 3
+          end
+        else
+          @result = Blazer::RunStatement.new.perform(@data_source, @statement, options)
+        end
+
+        if @result
+          @data_source.delete_results(@run_id) if @run_id
+
+          @columns = @result.columns
+          @rows = @result.rows
+          @error = @result.error
+          @cached_at = @result.cached_at
+          @just_cached = @result.just_cached
+
+          @forecast = @query && @result.forecastable? && params[:forecast]
+          if @forecast
+            @result.forecast
+            @forecast_error = @result.forecast_error
+            @forecast = @forecast_error.nil?
+          end
+
+          render_run
+        else
+          @timestamp = Time.now.to_i
+          continue_run
+        end
+      else
+        render layout: false
+      end
+    end
+
+    def refresh
+      data_source = Blazer.data_sources[@query.data_source]
+      @statement = @query.statement.dup
+      process_vars(@statement, @query.data_source)
+      Blazer.transform_statement.call(data_source, @statement) if Blazer.transform_statement
+      data_source.clear_cache(@statement)
+      redirect_to query_path(@query, variable_params(@query))
+    end
+
+    def update
+      if params[:commit] == "Fork"
+        @query = Blazer::Query.new
+        @query.creator = blazer_user if @query.respond_to?(:creator)
+      end
+      unless @query.editable?(blazer_user)
+        @query.errors.add(:base, "Sorry, permission denied")
+      end
+      if @query.errors.empty? && @query.update(query_params)
+        redirect_to query_path(@query, variable_params(@query))
+      else
+        render_errors @query
+      end
+    end
+
+    def destroy
+      @query.destroy if @query.editable?(blazer_user)
+      redirect_to root_path
+    end
+
+    def tables
+      render json: @data_source.tables
+    end
+
+    def docs
+      @smart_variables = @data_source.smart_variables
+      @linked_columns = @data_source.linked_columns
+      @smart_columns = @data_source.smart_columns
+    end
+
+    def schema
+      @schema = @data_source.schema
+    end
+
+    def cancel
+      @data_source.cancel(blazer_run_id)
+      head :ok
+    end
+
+    private
+
+      def set_data_source
+        @data_source = Blazer.data_sources[params[:data_source]]
+
+        unless Query.new(data_source: @data_source.id).editable?(blazer_user)
+          render_forbidden
+        end
+      end
+
+      def continue_run
+        render json: {run_id: @run_id, timestamp: @timestamp}, status: :accepted
+      end
+
+      def render_run
+        @checks = @query ? @query.checks.order(:id) : []
+
+        @first_row = @rows.first || []
+        @column_types = []
+        if @rows.any?
+          @columns.each_with_index do |_, i|
+            @column_types << (
+              case @first_row[i]
+              when Integer
+                "int"
+              when Float, BigDecimal
+                "float"
+              else
+                "string-ins"
+              end
+            )
+          end
+        end
+
+        @filename = @query.name.parameterize if @query
+        @min_width_types = @columns.each_with_index.select { |c, i| @first_row[i].is_a?(Time) || @first_row[i].is_a?(String) || @data_source.smart_columns[c] }.map(&:last)
+
+        @boom = @result.boom if @result
+
+        @linked_columns = @data_source.linked_columns
+
+        @markers = []
+        [["latitude", "longitude"], ["lat", "lon"], ["lat", "lng"]].each do |keys|
+          lat_index = @columns.index(keys.first)
+          lon_index = @columns.index(keys.last)
+          if lat_index && lon_index
+            @markers =
+              @rows.select do |r|
+                r[lat_index] && r[lon_index]
+              end.map do |r|
+                {
+                  # Mapbox.js does sanitization with https://github.com/mapbox/sanitize-caja
+                  # but we should do it here as well
+                  title: r.each_with_index.map { |v, i| i == lat_index || i == lon_index ? nil : "<strong>#{ERB::Util.html_escape(@columns[i])}:</strong> #{ERB::Util.html_escape(v)}" }.compact.join("<br />").truncate(140),
+                  latitude: r[lat_index],
+                  longitude: r[lon_index]
+                }
+              end
+          end
+        end
+
+        respond_to do |format|
+          format.html do
+            render layout: false
+          end
+          format.csv do
+            send_data csv_data(@columns, @rows, @data_source), type: "text/csv; charset=utf-8; header=present", disposition: "attachment; filename=\"#{@query.try(:name).try(:parameterize).presence || 'query'}.csv\""
+          end
+        end
+      end
+
+      def set_queries(limit = nil)
+        @queries = Blazer::Query.named.select(:id, :name, :creator_id, :statement)
+        @queries = @queries.includes(:creator) if Blazer.user_class
+
+        if blazer_user && params[:filter] == "mine"
+          @queries = @queries.where(creator_id: blazer_user.id).reorder(updated_at: :desc)
+        elsif blazer_user && params[:filter] == "viewed" && Blazer.audit
+          @queries = queries_by_ids(Blazer::Audit.where(user_id: blazer_user.id).order(created_at: :desc).limit(500).pluck(:query_id).uniq)
+        else
+          @queries = @queries.limit(limit) if limit
+          @queries = @queries.order(:name)
+        end
+        @queries = @queries.to_a
+
+        @more = limit && @queries.size >= limit
+
+        @queries = @queries.select { |q| !q.name.to_s.start_with?("#") || q.try(:creator).try(:id) == blazer_user.try(:id) }
+
+        @queries =
+          @queries.map do |q|
+            {
+              id: q.id,
+              name: q.name,
+              creator: blazer_user && q.try(:creator) == blazer_user ? "You" : q.try(:creator).try(Blazer.user_name),
+              vars: q.variables.join(", "),
+              to_param: q.to_param
+            }
+          end
+      end
+
+      def queries_by_ids(favorite_query_ids)
+        queries = Blazer::Query.named.where(id: favorite_query_ids)
+        queries = queries.includes(:creator) if Blazer.user_class
+        queries = queries.index_by(&:id)
+        favorite_query_ids.map { |query_id| queries[query_id] }.compact
+      end
+
+      def set_query
+        @query = Blazer::Query.find(params[:id].to_s.split("-").first)
+
+        unless @query.viewable?(blazer_user)
+          render_forbidden
+        end
+      end
+
+      def render_forbidden
+        render plain: "Access denied", status: :forbidden
+      end
+
+      def query_params
+        params.require(:query).permit(:name, :description, :statement, :data_source)
+      end
+
+      def blazer_params
+        params[:blazer] || {}
+      end
+
+      def csv_data(columns, rows, data_source)
+        CSV.generate do |csv|
+          csv << columns
+          rows.each do |row|
+            csv << row.each_with_index.map { |v, i| v.is_a?(Time) ? blazer_time_value(data_source, columns[i], v) : v }
+          end
+        end
+      end
+
+      def blazer_time_value(data_source, k, v)
+        data_source.local_time_suffix.any? { |s| k.ends_with?(s) } ? v.to_s.sub(" UTC", "") : v.in_time_zone(Blazer.time_zone)
+      end
+      helper_method :blazer_time_value
+
+      def blazer_run_id
+        params[:run_id].to_s.gsub(/[^a-z0-9\-]/i, "")
+      end
+  end
+end