your_platform 0.0.1 → 0.0.2

data/app/assets/stylesheets/your_platform/search_preview.css.sass

@@ -0,0 +1,4 @@
+table.user_preview
+  td
+    padding: 5px
+    vertical-align: top

data/app/assets/stylesheets/your_platform/star_tool.css.sass

@@ -0,0 +1,2 @@
+span.star
+  cursor: pointer

data/app/assets/stylesheets/your_platform/tooltips.css.sass

@@ -0,0 +1,7 @@
+div.tooltip
+  background: transparent
+  border: transparent
+
+.tooltip.left
+  margin-left: -27px
+  

data/app/assets/stylesheets/your_platform/turbolinks_loading_spinner.css.sass

@@ -0,0 +1,3 @@
+.page-spinner-icon
+  padding-left: 8px
+  padding-right: 8px

data/app/assets/stylesheets/your_platform/user_avatars.css.sass

@@ -0,0 +1,8 @@
+.avatar.thumbnail.pull-left
+  .avatar
+    display: block
+    margin-bottom: 10px
+  .remove_avatar
+    margin-top: 10px
+    height: 19px
+    padding-top: 0px

data/app/assets/stylesheets/your_platform/user_group_memberships.css.sass

@@ -0,0 +1,4 @@
+table.memberships
+  tr.currently_valid
+  tr.currently_invalid
+    background: lightgrey

data/app/assets/stylesheets/your_platform/vertical_nav.css.sass

@@ -0,0 +1,7 @@
+.vertical_menu
+  li.active
+    margin-bottom: 3px
+  li.child.group
+  li.child.page
+    margin-top: -3px
+    margin-bottom: 4px

data/app/controllers/activities_controller.rb

@@ -0,0 +1,6 @@
+class ActivitiesController < ApplicationController
+  def index
+    authorize! :read, PublicActivity::Activity
+    @activities = PublicActivity::Activity.order('created_at desc').limit(100)
+  end
+end

data/app/controllers/application_controller.rb

@@ -0,0 +1,236 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+
+  layout "bootstrap"
+
+  # TODO: Change before_filter to before_action  (http://stackoverflow.com/questions/16519828)
+  #
+  before_filter :redirect_www_subdomain, :set_locale
+  helper_method :current_user
+  helper_method :current_navable, :current_navable=, :point_navigation_to
+  before_filter :log_generic_metric_event
+  helper_method :metric_logger
+  before_filter :authorize_miniprofiler
+  before_filter :accept_terms_of_use
+  
+  after_filter  :log_activity
+  
+  # https://github.com/ryanb/cancan
+  # 
+  check_authorization(:unless => :devise_controller?)
+  rescue_from CanCan::AccessDenied do |exception|
+    session['return_to_after_login'] = request.fullpath 
+    redirect_to errors_unauthorized_url
+  end
+  
+  # This method returns the currently signed in user.
+  #
+  def current_user
+    current_user_account.user if current_user_account
+  end
+  
+  # This method returns the navable object the navigational elements on the 
+  # currently shown page point to.
+  #
+  # For example, if the bread crumb navigation reads 'Start > Intranet > News', 
+  # the current_navable would return the with 'News' associated navable object.
+  # 
+  # This also means, that the current_navable has to be set in the controller
+  # through point_navigation_to.
+  # 
+  def current_navable
+    @navable
+  end
+  
+  # This method sets the currently shown navable object. 
+  # Have a look at #current_navable.
+  #
+  def current_navable=( navable )
+    @navable = navable
+  end
+  def point_navigation_to( navable )
+    self.current_navable = navable
+  end
+  
+  # Redirect the www subdomain to non-www, e.g.
+  # http://www.example.com to http://example.com.
+  #
+  def redirect_www_subdomain
+    if (request.host.split('.')[0] == 'www') and (not Rails.env.test?)
+      # A flash cross-domain flash message would only work if the cookies are shared between the subdomains.
+      # But we won't make this decision for the main app, since this can be a security risk on shared domains.
+      # More info on sharing the cookie: http://stackoverflow.com/questions/12359522/
+      #
+      flash[:notice] = I18n.t(:you_may_leave_out_www)
+      redirect_to "http://" + request.host.gsub('www.','')
+    end
+  end
+  
+  # The locale of the application s set as follows:
+  #   1. Use the url parameter 'locale' if given.
+  #   2. Use the language of the web browser if supported by the app.
+  #   3. Use the default locale if no other could be determined.
+  #
+  def set_locale
+    cookies[:locale] = secure_locale_param if params[:locale].present?
+    cookies[:locale] = nil if params[:locale] and params[:locale] == ""
+    cookies[:locale] = nil if cookies[:locale] == ""
+    I18n.locale = cookies[:locale] || browser_language_if_supported_by_app || I18n.default_locale
+  end
+  
+  private
+  
+  # This method prevents a DoS attack.
+  #
+  def secure_locale_param
+    if params[:locale].present? and params[:locale].in? I18n.available_locales.collect { |l| l.to_s }
+      params[:locale] 
+    end
+  end
+  
+  def secure_locale_from_accept_language_header
+    # This comparison is to prevent a DoS attack.
+    # See: http://brakemanscanner.org/docs/warning_types/denial_of_service/
+    #
+    I18n.available_locales.select do |locale|
+      locale.to_s == locale_from_accept_language_header
+    end.first
+  end
+  def locale_from_accept_language_header
+    # see: http://guides.rubyonrails.org/i18n.html
+    if request.env['HTTP_ACCEPT_LANGUAGE'] and not Rails.env.test?
+      request.env['HTTP_ACCEPT_LANGUAGE'].scan(/^[a-z]{2}/).first
+    end
+  end
+  def browser_language_if_supported_by_app
+    secure_locale_from_accept_language_header
+  end
+  
+  # This logs the event using a metric storage.
+  # Here, we use fnordmetric. The metrics can be viewed via
+  #
+  #   http://localhost:4242
+  #
+  # when the deamon is started via
+  #
+  #   bundle exec foreman start fnordmetric
+  #
+  def log_generic_metric_event
+    unless read_only_mode?
+      type = "#{self.class.name.underscore}_#{action_name}"  # e.g. pages_controller_show
+      metric_logger.log_event( { id: params[:id] }, type: type)
+      metric_logger.log_event( { request_type: type }, type: :generic_request)
+    end
+  end
+  def metric_logger
+    @metric_logger ||= MetricLogger.new(current_user: current_user, session_id: session[:session_id])
+  end
+  
+  # Generic Activity Logger
+  #
+  def log_activity
+    if not read_only_mode? and not action_name.in?(["index", "show", "download", "autocomplete_title", "preview", "description"]) and not params['controller'].in?(['sessions', 'devise/sessions'])
+      begin
+        type = self.class.name.gsub("Controller", "").singularize
+        id = params[:id]
+        object = type.constantize.find(id)
+      rescue
+        # there is no object associated, e.g. for the RootController
+      end
+      
+      PublicActivity::Activity.create!(
+        trackable: object,
+        key: action_name,
+        owner: current_user,
+        parameters: params.except('authenticity_token', 'attachment').deep_merge({
+          "user" => {avatar: nil},
+          "user_account" => {password: nil, password_confirmation: nil}
+        })
+      )
+    end
+  end
+  
+  # MiniProfiler is a tool that shows the page load time in the top left corner of
+  # the browser. But, in production, this feature should only be visible to developers.
+  #
+  # If the current_user can? :read the :mini_profiler, is defined in the Ability class.
+  #
+  def authorize_miniprofiler
+    Rack::MiniProfiler.authorize_request if can? :use, Rack::MiniProfiler
+  end
+  
+  
+  def accept_terms_of_use
+    if current_user && (not read_only_mode?) && (not controller_name.in?(['terms_of_use', 'sessions', 'passwords', 'user_accounts', 'attachments', 'errors'])) && (not TermsOfUseController.accepted?(current_user))
+      if request.url.include?('redirect_after')
+        redirect_after = root_path
+      else
+        redirect_after = request.url
+      end
+      redirect_to controller: 'terms_of_use', action: 'index', redirect_after: redirect_after
+    end
+  end
+  
+  
+  # This overrides the `current_ability` method of `cancan`
+  # in order to allow additional options that are needed for a preview mechanism.
+  # 
+  # Warning! Make sure to handle these options very carefully to not allow
+  # malicious injections.
+  #
+  # The original method can be found here:
+  # https://github.com/ryanb/cancan/blob/master/lib/cancan/controller_additions.rb#L356
+  #
+  def current_ability(reload = false)
+    options = {}
+    @current_ability = nil if reload
+    
+    # Read-only mode
+    options[:read_only_mode] = true if read_only_mode?
+    
+    # Preview role mechanism
+    #
+    if @current_ability.nil? and current_user
+      currently_displayed_object = @navable
+      currently_displayed_object ||= Group.everyone  # this causes to determine the role for searches and indices based on the role for the everyone group.
+      role = Role.of(current_user).for(currently_displayed_object)
+      options[:role] = role
+      params[:preview_as] ||= load_preview_as_from_cookie
+      save_preview_as_cookie(params[:preview_as])
+      if params[:preview_as].present? && current_user && currently_displayed_object
+        if params[:preview_as].in?(role.allowed_preview_roles)
+          options[:preview_as] = params[:preview_as]
+        else
+          cookies.delete :preview_as
+          options[:preview_as] = nil
+          params[:preview_as] = nil
+        end
+      end
+    end
+
+    @current_ability ||= ::Ability.new(current_user, params, options)
+  end
+  
+  def reload_ability
+    current_ability(true)
+  end
+  
+  def load_preview_as_from_cookie
+    cookies[:preview_as]
+  end
+  def save_preview_as_cookie(preview_as)
+    cookies[:preview_as] = preview_as
+  end
+  
+  # Read-only mode for maintenance purposes.
+  #
+  def read_only_mode?
+    @read_only_mode ||= ActiveRecord::Base.read_only_mode?
+  end
+  helper_method :read_only_mode?
+  
+  def after_sign_in_path_for(resource)
+    session['return_to_after_login'] || root_path
+  end
+
+end

data/app/controllers/attachments_controller.rb

@@ -0,0 +1,97 @@
+class AttachmentsController < ApplicationController
+  
+  load_and_authorize_resource
+  skip_authorize_resource only: [:create, :description]
+  respond_to :html, :json
+  
+  def index
+  end
+
+  def create
+    if secure_parent
+      authorize! :create_attachment_for, secure_parent
+      secure_parent.touch
+    else
+      authorize! :create, Attachment
+    end
+    @attachment = Attachment.create! author: current_user
+    @attachment.update_attributes(params[:attachment])
+  end
+
+
+  # PUT /attachments/1
+  # PUT /attachments/1.json
+  def update
+    @attachment = Attachment.find(params[:id])
+
+    respond_to do |format|
+      if @attachment.update_attributes(params[:attachment])
+        format.html { redirect_to @attachment, notice: 'Attachment was successfully updated.' }
+        format.json { head :no_content }
+      else
+        format.html { render action: "edit" }
+        format.json { render json: @attachment.errors, status: :unprocessable_entity }
+      end
+    end
+  end
+
+  def destroy
+    @attachment = Attachment.find(params[:id])
+    @attachment.destroy
+  end
+
+  # This action allows to download a file, which is not in the public/ directory
+  # but at a secured location. That way, access control for uploaded files cannot
+  # be circumvented by downloading files directly from the public folder.
+  #
+  # https://github.com/carrierwaveuploader/carrierwave/wiki/How-To%3A-Secure-Upload
+  #
+  def download
+    path = ""
+    if secure_version
+      if @attachment.file.versions[secure_version]
+        path = @attachment.file.versions[secure_version].current_path
+      end
+    else
+      path = @attachment.file.current_path
+    end
+    send_file path, x_sendfile: true, disposition: :inline
+  end
+  
+  # This returns a json object with description information of the
+  # requested file.
+  #
+  def description
+    @attachment = Attachment.find(params[:attachment_id])
+    authorize! :read, @attachment
+
+    respond_to do |format|
+      format.json do
+        self.formats = [:html, :json]
+        render json: {
+          title: @attachment.title,
+          description: @attachment.description,
+          author: @attachment.author.title,
+          html: render_to_string(partial: 'attachments/description', formats: [:html], locals: {attachment: @attachment})
+        }
+      end
+    end
+  end
+  
+private
+
+  # This method secures the version parameter from a DoS attack.
+  # See: http://brakemanscanner.org/docs/warning_types/denial_of_service/
+  #
+  def secure_version
+    @secure_version ||= AttachmentUploader.valid_versions.select do |version|
+      version.to_s == params[:version]
+    end.first
+  end
+  
+  def secure_parent
+    Page.find(params[:attachment][:parent_id]) if params[:attachment][:parent_type] == 'Page'
+    Event.find(params[:attachment][:parent_id]) if params[:attachment][:parent_type] == 'Event'
+  end
+
+end

data/app/controllers/blog_posts_controller.rb

@@ -0,0 +1,50 @@
+# The display of a blog is handled by the PagesController and the Page-associated views.
+# This controller is just for adding a blog post via AJAX.
+#
+class BlogPostsController < PagesController
+  prepend_before_filter :set_inheritance_instance_variable
+  
+  load_and_authorize_resource
+  skip_authorize_resource only: [:create]
+  
+  respond_to :json, :js
+  
+  def show
+    redirect_to page_url(id: params[:id])
+  end
+
+  def create
+    secure_parent.present? || raise('A blog post requires a parent_id to identify the parent page.')
+    authorize! :create_page_for, secure_parent
+
+    @blog_post || raise('No @blog_post created by cancan.')
+    @blog_post.title = I18n.t(:new_blog_post)
+    @blog_post.author = current_user
+    @blog_post.content = "—"
+    @blog_post.save!
+    @blog_post.parent_pages << secure_parent
+    @page = @blog_post
+    @navable = @blog_post            # this is needed in the BoxHelper in order to show the edit button.
+    @blog_entries = [@blog_post]     # this is needed in the BoxHelper in order to hide the attachment box.
+    @this_is_a_new_blog_post = true  # in to make the header a link.
+    respond_to do |format|
+      format.js
+    end
+  end
+
+  def update
+    set_inheritance_instance_variable
+    @blog_post.update_attributes params[ :blog_post ].select { |k,v| v.present? && (v != "—")}
+    respond_with_bip(@blog_post)
+  end
+  
+  private
+  
+  def set_inheritance_instance_variable
+    @page = @blog_post
+    @pages = @blog_posts
+    params[:page] = params[:blog_post]
+  end
+  
+end
+

data/app/controllers/bookmarks_controller.rb

@@ -0,0 +1,33 @@
+class BookmarksController < ApplicationController
+
+  respond_to :json
+
+  def show
+    respond_with Bookmark.find( params[ :id ] )
+  end
+
+  def index
+#    @stars = find_stars
+    respond_with find_bookmarks
+#    respond_to do |format|
+#      format.json { respond_with @stars }
+#      format.html
+#    end
+  end
+
+  def create
+    respond_with Bookmark.create( params[ :bookmark ] )
+  end
+
+  def destroy
+    respond_with Bookmark.find( params[ :id ] ).destroy
+  end
+
+  private 
+
+  def find_bookmarks
+    user = User.find params[ :user_id ] if params[ :user_id ].present?
+    Bookmark.find_all_by_user( user ) if user
+  end
+
+end