six-updater-web 0.10.8 → 0.11.1

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/print_base.rb

@@ -0,0 +1,23 @@
+module ActiveScaffold::Actions
+  module PrintBase
+    include ActiveScaffold::Search
+    protected
+    
+    def do_print_list(print_list_config)
+      active_scaffold_config.list.empty_field_text = print_list_config.empty_field_text
+      includes_for_print_list_columns = active_scaffold_tools_list_columns.collect{ |c| c.includes }.flatten.uniq.compact
+      self.active_scaffold_joins.concat includes_for_print_list_columns
+
+      options = {:sorting => active_scaffold_config.list.user.sorting,
+        :per_page => print_list_config.maximum_rows}
+
+      do_search
+      
+      do_print_list_find(options)
+    end
+
+    def do_print_list_find(options)
+      @records = find_page(options);
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/print_list.rb

@@ -0,0 +1,44 @@
+module ActiveScaffold::Actions
+  module PrintList
+    include ActiveScaffold::Search
+    include ActiveScaffold::Actions::PrintBase
+
+    def self.included(base)
+      base.before_filter :print_list_authorized_filter, :only => [:print_list]
+    end
+
+    def print_list
+      do_print_list active_scaffold_config.print_list
+
+      respond_to do |type|
+        type.html {
+          render(:partial => 'print_list', :layout => false)
+        }
+        # not working
+        # type.pdf {
+        #   @html = render_to_string(:partial => "print_list.html.erb", :layout => false)
+        #   prawnto :prawn => {:page_layout => :landscape}, :inline => true
+        #   render :layout => false
+        # }
+        type.xml { render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status }
+        type.json { render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status }
+        type.yaml { render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status }
+      end
+    end
+
+    protected
+   
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def print_list_authorized?
+      authorized_for?(:action => :read)
+    end
+
+    private
+
+    def print_list_authorized_filter
+      raise ActiveScaffold::ActionNotAllowed unless print_list_authorized?
+    end
+    
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/refresh.rb

@@ -0,0 +1,31 @@
+module ActiveScaffold::Actions
+  module Refresh
+    def self.included(base)
+      base.before_filter :refresh_authorized_filter, :only => [:index, :list]
+    end
+
+    def refresh
+      respond_to do |type|
+        type.js do
+          do_list
+          render :update do |page|
+            page[active_scaffold_content_id].replace_html render(:partial => 'list', :layout => false)
+          end
+        end
+        type.html { return_to_main }
+      end
+    end
+    
+    protected
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def refresh_authorized?
+      authorized_for?(:action => :read)
+    end
+    private
+    def refresh_authorized_filter
+      raise ActiveScaffold::ActionNotAllowed unless refresh_authorized?
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/revision.rb

@@ -0,0 +1,51 @@
+# 
+# Works with acts_as_revisionable plugin
+# 
+module ActiveScaffold::Actions
+  module Revision
+    def self.included(base)
+      base.before_filter :revision_authorized?, :only => :revision
+    end
+
+    def revision
+      do_revision
+
+      successful?
+      respond_to do |type|
+        type.html { render :action => 'revision', :layout => true }
+        type.js { render :partial => 'revision', :layout => false }
+        type.xml { render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status }
+        type.json { render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status }
+        type.yaml { render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status }
+      end
+    end
+
+    def next_revision
+      @revision_number = params[:revision_number].to_i + 2 if params[:revision_number]
+      revision
+    end
+    
+    def previous_revision
+      @revision_number = params[:revision_number].to_i - 2 if params[:revision_number]
+      revision
+    end
+    
+    protected
+
+    # A simple method to retrieve and prepare a record for revisioning.
+    # May be overridden to customize revision routine
+    def do_revision
+      @record = find_if_allowed(params[:id], :read)
+      @current_revision_number = @record.current_revision_number
+      @revision_number ||= @current_revision_number
+      @rev_record_1 = @record.restore_revision(@revision_number) if @revision_number
+      @rev_record_2 = @record.restore_revision(@revision_number - 1) if @revision_number > 1
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def revision_authorized?
+      authorized_for?(:action => :read)
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/search.rb

@@ -0,0 +1,50 @@
+module ActiveScaffold::Actions
+  module Search
+    def self.included(base)
+      base.before_filter :search_authorized_filter, :only => :show_search
+      base.before_filter :do_search
+    end
+
+    def show_search
+      respond_to_action(:search)
+    end
+
+    protected
+    def search_respond_to_html
+      render(:action => "search")
+    end
+    def search_respond_to_js
+      render(:partial => "search")
+    end
+    def do_search
+      @query = params[:search].to_s.strip rescue ''
+
+      unless @query.empty?
+        columns = active_scaffold_config.search.columns
+        like_pattern = active_scaffold_config.search.full_text_search? ? '%?%' : '?%'
+        search_conditions = self.class.create_conditions_for_columns(@query.split(' '), columns, like_pattern)
+        self.active_scaffold_conditions = merge_conditions(self.active_scaffold_conditions, search_conditions)
+        @filtered = !search_conditions.blank?
+
+        includes_for_search_columns = columns.collect{ |column| column.includes}.flatten.uniq.compact
+        self.active_scaffold_joins.concat includes_for_search_columns
+
+        active_scaffold_config.list.user.page = nil
+      end
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def search_authorized?
+      authorized_for?(:action => :read)
+    end
+    private
+    def search_authorized_filter
+      link = active_scaffold_config.search.link || active_scaffold_config.search.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def search_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.search.formats).uniq
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/show.rb

@@ -0,0 +1,54 @@
+module ActiveScaffold::Actions
+  module Show
+    def self.included(base)
+      base.before_filter :show_authorized_filter, :only => :show
+    end
+
+    def show
+      do_show
+      successful?
+      respond_to_action(:show)
+    end
+
+    protected
+    
+    def show_respond_to_json
+      render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+
+    def show_respond_to_yaml
+      render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+
+    def show_respond_to_xml
+      render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+
+    def show_respond_to_js
+      render :partial => 'show'
+    end
+
+    def show_respond_to_html
+      render :action => 'show'
+    end
+    # A simple method to retrieve and prepare a record for showing.
+    # May be overridden to customize show routine
+    def do_show
+      @record = find_if_allowed(params[:id], :read)
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def show_authorized?
+      authorized_for?(:action => :read)
+    end
+    private 
+    def show_authorized_filter
+      link = active_scaffold_config.show.link || active_scaffold_config.show.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def show_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.show.formats).uniq
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/subform.rb

@@ -0,0 +1,17 @@
+module ActiveScaffold::Actions
+  module Subform
+    def edit_associated
+      @parent_record = params[:id].nil? ? active_scaffold_config.model.new : find_if_allowed(params[:id], :update)
+      @column = active_scaffold_config.columns[params[:association]]
+
+      # NOTE: we don't check whether the user is allowed to update this record, because if not, we'll still let them associate the record. we'll just refuse to do more than associate, is all.
+      @record = @column.association.klass.find(params[:associated_id]) if params[:associated_id]
+      @record ||= @column.association.klass.new
+
+      @scope = "[#{@column.name}]"
+      @scope += (@record.new_record?) ? "[#{(Time.now.to_f*1000).to_i.to_s}]" : "[#{@record.id}]" if @column.plural_association?
+
+      render :action => 'edit_associated'
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/actions/update.rb

@@ -0,0 +1,128 @@
+module ActiveScaffold::Actions
+  module Update
+    def self.included(base)
+      base.before_filter :update_authorized_filter, :only => [:edit, :update]
+      base.verify :method => [:post, :put],
+                  :only => :update,
+                  :redirect_to => { :action => :index }
+    end
+
+    def edit
+      do_edit
+      respond_to_action(:edit)
+    end
+
+    def update
+      do_update
+      respond_to_action(:update)
+    end
+
+    # for inline (inlist) editing
+    def update_column
+      do_update_column
+      render :action => 'update_column'
+    end
+
+    protected
+    def edit_respond_to_html
+      if successful?
+        render(:action => 'update')
+      else
+        return_to_main
+      end
+    end
+    def edit_respond_to_js
+      render(:partial => 'update_form')
+    end
+    def update_respond_to_html  
+      if params[:iframe]=='true' # was this an iframe post ?
+        responds_to_parent do
+          if successful?
+            render :action => 'on_update.js'
+          else
+            render :action => 'form_messages_on_save.js'
+          end
+        end
+      else # just a regular post
+        if successful?
+          flash[:info] = as_(:updated_model, :model => @record.to_label)
+          return_to_main
+        else
+          render(:action => 'update')
+        end
+      end
+    end
+    def update_respond_to_js
+      render :action => 'on_update'
+    end
+    def update_respond_to_xml
+      render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+    def update_respond_to_json
+      render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+    def update_respond_to_yaml
+      render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+    # A simple method to find and prepare a record for editing
+    # May be overridden to customize the record (set default values, etc.)
+    def do_edit
+      @record = find_if_allowed(params[:id], :update)
+    end
+
+    # A complex method to update a record. The complexity comes from the support for subforms, and saving associated records.
+    # If you want to customize this algorithm, consider using the +before_update_save+ callback
+    def do_update
+      do_edit
+      begin
+        active_scaffold_config.model.transaction do
+          @record = update_record_from_params(@record, active_scaffold_config.update.columns, params[:record])
+          before_update_save(@record)
+          self.successful = [@record.valid?, @record.associated_valid?].all? {|v| v == true} # this syntax avoids a short-circuit
+          if successful?
+            @record.save! and @record.save_associated!
+            after_update_save(@record)
+          end
+        end
+      rescue ActiveRecord::RecordInvalid
+      rescue ActiveRecord::StaleObjectError
+        @record.errors.add_to_base as_(:version_inconsistency)
+        self.successful=false
+      end
+    end
+
+    def do_update_column
+      @record = active_scaffold_config.model.find(params[:id])
+      if @record.authorized_for?(:action => :update, :column => params[:column])
+        column = active_scaffold_config.columns[params[:column].to_sym]
+        params[:value] ||= @record.column_for_attribute(params[:column]).default unless @record.column_for_attribute(params[:column]).nil? || @record.column_for_attribute(params[:column]).null
+        params[:value] = column_value_from_param_value(@record, column, params[:value]) unless column.nil?
+        @record.send("#{params[:column]}=", params[:value])
+        @record.save
+      end
+    end
+
+    # override this method if you want to inject data in the record (or its associated objects) before the save
+    def before_update_save(record); end
+
+    # override this method if you want to do something after the save
+    def after_update_save(record); end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def update_authorized?
+      authorized_for?(:action => :update)
+    end
+    private
+    def update_authorized_filter
+      link = active_scaffold_config.update.link || active_scaffold_config.update.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def edit_formats
+      (default_formats + active_scaffold_config.formats).uniq
+    end
+    def update_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.update.formats).uniq
+    end
+  end
+end

data/lib/vendor/plugins/active_scaffold/lib/active_scaffold/attribute_params.rb

@@ -0,0 +1,196 @@
+module ActiveScaffold
+  # Provides support for param hashes assumed to be model attributes.
+  # Support is primarily needed for creating/editing associated records using a nested hash structure.
+  #
+  # Paradigm Params Hash (should write unit tests on this):
+  #   params[:record] = {
+  #     # a simple record attribute
+  #     'name' => 'John',
+  #     # a plural association hash
+  #     'roles' => {
+  #       # associate with an existing role
+  #       '5' => {'id' => 5}
+  #       # associate with an existing role and edit it
+  #       '6' => {'id' => 6, 'name' => 'designer'}
+  #       # create and associate a new role
+  #       '124521' => {'name' => 'marketer'}
+  #     }
+  #     # a singular association hash
+  #     'location' => {'id' => 12, 'city' => 'New York'}
+  #   }
+  #
+  # Simpler association structures are also supported, like:
+  #   params[:record] = {
+  #     # a simple record attribute
+  #     'name' => 'John',
+  #     # a plural association ... all ids refer to existing records
+  #     'roles' => ['5', '6'],
+  #     # a singular association ... all ids refer to existing records
+  #     'location' => '12'
+  # }
+  module AttributeParams
+    # Takes attributes (as from params[:record]) and applies them to the parent_record. Also looks for
+    # association attributes and attempts to instantiate them as associated objects.
+    #
+    # This is a secure way to apply params to a record, because it's based on a loop over the columns
+    # set. The columns set will not yield unauthorized columns, and it will not yield unregistered columns.
+    def update_record_from_params(parent_record, columns, attributes)
+      action = parent_record.new_record? ? :create : :update
+      return parent_record unless parent_record.authorized_for?(:action => action)
+
+      multi_parameter_attributes = {}
+      attributes.each do |k, v|
+        next unless k.include? '('
+        column_name = k.split('(').first.to_sym
+        multi_parameter_attributes[column_name] ||= []
+        multi_parameter_attributes[column_name] << [k, v]
+      end
+
+      columns.each :for => parent_record, :action => action, :flatten => true do |column|
+        if multi_parameter_attributes.has_key? column.name
+          parent_record.send(:assign_multiparameter_attributes, multi_parameter_attributes[column.name])
+        elsif attributes.has_key? column.name
+          value = column_value_from_param_value(parent_record, column, attributes[column.name]) 
+
+          # we avoid assigning a value that already exists because otherwise has_one associations will break (AR bug in has_one_association.rb#replace)
+          parent_record.send("#{column.name}=", value) unless column.through_association? or parent_record.send(column.name) == value
+          
+          # Set any passthrough parameters that may be associated with this column (ie, file column "keep" and "temp" attributes)
+          unless column.params.empty?
+            column.params.each{|p| parent_record.send("#{p}=", attributes[p])}
+          end
+
+        # plural associations may not actually appear in the params if all of the options have been unselected or cleared away.
+        # NOTE: the "form_ui" check isn't really necessary, except that without it we have problems
+        # with subforms. the UI cuts out deep associations, which means they're not present in the
+        # params even though they're in the columns list. the result is that associations were being
+        # emptied out way too often. BUT ... this means there's still a lingering bug in the default association
+        # form code: you can't delete the last association in the list.
+        elsif column.form_ui and column.plural_association? and not column.through_association?
+          parent_record.send("#{column.name}=", [])
+        end
+      end
+
+      if parent_record.new_record?
+        parent_record.class.reflect_on_all_associations.each do |a|
+          next unless [:has_one, :has_many].include?(a.macro) and not a.options[:through]
+          next unless association_proxy = parent_record.send(a.name)
+
+          raise ActiveScaffold::ReverseAssociationRequired, "Association #{a.name}: In order to support :has_one and :has_many where the parent record is new and the child record(s) validate the presence of the parent, ActiveScaffold requires the reverse association (the belongs_to)." unless a.reverse
+
+          association_proxy = [association_proxy] if a.macro == :has_one
+          association_proxy.each { |record| record.send("#{a.reverse}=", parent_record) }
+        end
+      end
+
+      parent_record
+    end
+    
+    def manage_nested_record_from_params(parent_record, column, attributes)
+      record = find_or_create_for_params(attributes, column, parent_record)
+      if record
+        record_columns = active_scaffold_config_for(column.association.klass).subform.columns
+        update_record_from_params(record, record_columns, attributes)
+        record.unsaved = true
+      end
+      record
+    end
+    
+    def column_value_from_param_value(parent_record, column, value)
+      # convert the value, possibly by instantiating associated objects
+      if value.is_a?(Hash)
+        # this is just for backwards compatibility. we should clean this up in 2.0.
+        if column.form_ui == :select
+          ids = if column.singular_association?
+            value[:id]
+          else
+            value.values.collect {|hash| hash[:id]}
+          end
+          (ids and not ids.empty?) ? column.association.klass.find(ids) : nil
+
+        elsif column.singular_association?
+          manage_nested_record_from_params(parent_record, column, value)
+        elsif column.plural_association?
+          value.collect {|key_value_pair| manage_nested_record_from_params(parent_record, column, key_value_pair[1])}.compact
+        end
+      else
+        if column.singular_association?
+          # it's a single id
+          column.association.klass.find(value) if value and not value.empty?
+        elsif column.plural_association?
+          # it's an array of ids
+          column.association.klass.find(value) if value and not value.empty?
+        elsif column.column && column.column.number? && [:i18n_number, :currency].include?(column.options[:format])
+          native = '.'
+          delimiter = I18n.t('number.format.delimiter')
+          separator = I18n.t('number.format.separator')
+
+          unless delimiter == native && !value.include?(separator) && value !~ /\.\d{3}$/
+            value.gsub(/[^0-9\-#{I18n.t('number.format.separator')}]/, '').gsub(I18n.t('number.format.separator'), native)
+          else
+            value
+          end
+        else
+          # convert empty strings into nil. this works better with 'null => true' columns (and validations),
+          # and 'null => false' columns should just convert back to an empty string.
+          # ... but we can at least check the ConnectionAdapter::Column object to see if nulls are allowed
+          value = nil if value.is_a? String and value.empty? and !column.column.nil? and column.column.null
+          value
+        end
+      end
+    end
+
+    # Attempts to create or find an instance of klass (which must be an ActiveRecord object) from the
+    # request parameters given. If params[:id] exists it will attempt to find an existing object
+    # otherwise it will build a new one.
+    def find_or_create_for_params(params, parent_column, parent_record)
+      current = parent_record.send(parent_column.name)
+      klass = parent_column.association.klass
+      return nil if parent_column.show_blank_record and attributes_hash_is_empty?(params, klass)
+
+      if params.has_key? :id
+        # modifying the current object of a singular association
+        if current and current.is_a? ActiveRecord::Base and current.id.to_s == params[:id]
+          return current
+        # modifying one of the current objects in a plural association
+        elsif current and current.respond_to?(:any?) and current.any? {|o| o.id.to_s == params[:id]}
+          return current.detect {|o| o.id.to_s == params[:id]}
+        # attaching an existing but not-current object
+        else
+          return klass.find(params[:id])
+        end
+      else
+        if klass.authorized_for?(:action => :create)
+          if parent_column.singular_association?
+            return parent_record.send("build_#{parent_column.name}")
+          else
+            return parent_record.send(parent_column.name).build
+          end
+        end
+      end
+    end
+
+    # Determines whether the given attributes hash is "empty".
+    # This isn't a literal emptiness - it's an attempt to discern whether the user intended it to be empty or not.
+    def attributes_hash_is_empty?(hash, klass)
+      hash.all? do |key,value|
+        # convert any possible multi-parameter attributes like 'created_at(5i)' to simply 'created_at'
+        column_name = key.to_s.split('(').first
+        column = klass.columns_hash[column_name]
+
+        # booleans and datetimes will always have a value. so we ignore them when checking whether the hash is empty.
+        # this could be a bad idea. but the current situation (excess record entry) seems worse.
+        next true if column and [:boolean, :datetime, :date, :time].include?(column.type)
+
+        # defaults are pre-filled on the form. we can't use them to determine if the user intends a new row.
+        next true if column and value == column.default.to_s
+
+        if value.is_a?(Hash)
+          attributes_hash_is_empty?(value, klass)
+        else
+          value.respond_to?(:empty?) ? value.empty? : false
+        end
+      end
+    end
+  end
+end