From 7f5af2747813eab0a0a4120642d8ccd32588fed4 Mon Sep 17 00:00:00 2001 From: cktricky Date: Tue, 19 Apr 2016 08:43:18 -0400 Subject: [PATCH] removed comments and Fixed Issue #184 --- app/controllers/admin_controller.rb | 2 -- app/controllers/api/v1/users_controller.rb | 3 --- app/controllers/application_controller.rb | 2 -- app/controllers/benefit_forms_controller.rb | 20 -------------------- app/controllers/messages_controller.rb | 1 - app/controllers/sessions_controller.rb | 3 --- app/controllers/users_controller.rb | 8 +------- app/controllers/work_info_controller.rb | 10 ---------- app/models/benefits.rb | 6 ------ app/models/user.rb | 19 +------------------ 10 files changed, 2 insertions(+), 72 deletions(-) diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb index 62c228a..a609bb6 100755 --- a/app/controllers/admin_controller.rb +++ b/app/controllers/admin_controller.rb @@ -10,8 +10,6 @@ class AdminController < ApplicationController fields = "*" else fields = params[:field].map {|k,v| k }.join(",") - # This seems to be a bit safer - #fields = params[:field].map {|k,v| Analytics.parse_field(k) }.join(",") end if params[:ip] diff --git a/app/controllers/api/v1/users_controller.rb b/app/controllers/api/v1/users_controller.rb index 643e5f9..d2dfa41 100644 --- a/app/controllers/api/v1/users_controller.rb +++ b/app/controllers/api/v1/users_controller.rb @@ -6,9 +6,6 @@ class Api::V1::UsersController < ApplicationController respond_to :json def index - # We removed the .as_json code from the model, just seemed like extra work. - # dunno, maybe useful at a later time? - #respond_with @user.admin ? User.all.as_json : @user.as_json respond_with @user.admin ? User.all : @user end diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index c8393dd..4f08d34 100755 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -32,7 +32,6 @@ class ApplicationController < ActionController::Base def administrative if not is_admin? - #reset_session redirect_to root_url end end @@ -57,6 +56,5 @@ class ApplicationController < ActionController::Base def sanitize_font(css) css - # css if css.match(/\A[0-9]+([\%]|pt)\z/) end end diff --git a/app/controllers/benefit_forms_controller.rb b/app/controllers/benefit_forms_controller.rb index 23546ba..2909769 100644 --- a/app/controllers/benefit_forms_controller.rb +++ b/app/controllers/benefit_forms_controller.rb @@ -25,24 +25,4 @@ class BenefitFormsController < ApplicationController redirect_to user_benefit_forms_path(:user_id => current_user.user_id) end -=begin - # More secure version - def download - file_assoc = {"1" => "Health_n_Stuff.pdf", "2" => "Dental_n_Stuff.pdf"} - begin - if file_assoc.has_key?(params[:name].to_s) - path = Rails.root.join('public', 'docs', file_assoc[params[:name].to_s]) - if params[:type] == "File" - file = params[:type].constantize.new(path) - send_file file, :disposition => 'attachment' - end - else - file = Rails.root.join('public', 'docs', "Dental_n_Stuff.pdf") - send_file file, :disposition => 'attachment' - end - rescue - redirect_to user_benefit_forms_path(:user_id => current_user.user_id) - end - end -=end end diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb index ec74bda..4ecb80b 100644 --- a/app/controllers/messages_controller.rb +++ b/app/controllers/messages_controller.rb @@ -3,7 +3,6 @@ class MessagesController < ApplicationController def index @messages = current_user.messages @message = Message.new - # Blocking code can cause DOS sleep(3) end diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index f9172d9..8586df4 100755 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -12,7 +12,6 @@ class SessionsController < ApplicationController begin # Normalize the email address, why not user = User.authenticate(params[:email].to_s.downcase, params[:password]) - # @url = params[:url] rescue Exception => e end @@ -24,8 +23,6 @@ class SessionsController < ApplicationController end redirect_to path else - # Removed this code, just doesn't seem specific enough! - # flash[:error] = "Either your username and password is incorrect" flash[:error] = e.message render "new" end diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 58ca211..649bbb4 100755 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -25,13 +25,7 @@ class UsersController < ApplicationController def update message = false - #Safest - # user = current_user - - # Still an Insecure DoR vulnerability - #user = User.find(:first, :conditions => ["user_id = ?", "#{params[:user][:user_id]}"]) - - # user = User.find(:first, :conditions => "user_id = '#{params[:user][:user_id]}'") + user = User.where("user_id = '#{params[:user][:user_id]}'").first if user user.skip_user_id_assign = true diff --git a/app/controllers/work_info_controller.rb b/app/controllers/work_info_controller.rb index 29727f4..f6d8362 100644 --- a/app/controllers/work_info_controller.rb +++ b/app/controllers/work_info_controller.rb @@ -7,14 +7,4 @@ class WorkInfoController < ApplicationController end end -=begin - # More secure version - def index - @user = current_user - if !(@user) || @user.admin - flash[:error] = "Apologies, looks like something went wrong" - redirect_to home_dashboard_index_path - end - end -=end end diff --git a/app/models/benefits.rb b/app/models/benefits.rb index 4deae64..0d9caa9 100644 --- a/app/models/benefits.rb +++ b/app/models/benefits.rb @@ -15,12 +15,6 @@ class Benefits < ActiveRecord::Base end end -=begin - def self.make_backup(file, data_path, full_file_name) - FileUtils.cp "#{full_file_name}", "#{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}" - end -=end - def self.silence_streams(*streams) on_hold = streams.collect { |stream| stream.dup } streams.each do |stream| diff --git a/app/models/user.rb b/app/models/user.rb index 9aae72e..91bf8a5 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -6,12 +6,7 @@ class User < ActiveRecord::Base :length => {:within => 6..40}, :on => :create, :if => :password -=begin - validates :password, :presence => true, - :confirmation => true, - :if => :password, - :format => {:with => /\A.*(?=.{10,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[\@\#\$\%\^\&\+\=]).*\z/} -=end + validates_presence_of :email validates_uniqueness_of :email validates_format_of :email, :with => /.+@.+\..+/i @@ -61,18 +56,6 @@ class User < ActiveRecord::Base return auth end -=begin - # More secure version, still lacking a decent hashing routine, this is for timing attack prevention - def self.authenticate(email, password) - user = find_by_email(email) || User.new(:password => "") - if Rack::Utils.secure_compare(user.password, Digest::MD5.hexdigest(password)) - return user - else - raise "Incorrect username or password" - end - end -=end - def assign_user_id unless @skip_user_id_assign.present? || self.user_id.present? user = User.order("user_id").last