79 lines
2.1 KiB
Ruby
Executable File
79 lines
2.1 KiB
Ruby
Executable File
# frozen_string_literal: true
|
|
class AdminController < ApplicationController
|
|
before_action :administrative, if: :admin_param, except: [:get_user]
|
|
skip_before_action :has_info
|
|
|
|
def dashboard
|
|
end
|
|
|
|
def analytics
|
|
if params[:field].nil?
|
|
fields = "*"
|
|
else
|
|
fields = custom_fields.join(",")
|
|
end
|
|
|
|
if params[:ip]
|
|
@analytics = Analytics.hits_by_ip(params[:ip], fields)
|
|
else
|
|
@analytics = Analytics.all
|
|
end
|
|
end
|
|
|
|
def get_all_users
|
|
@users = User.all
|
|
end
|
|
|
|
def get_user
|
|
@user = User.find_by_id(params[:admin_id].to_s)
|
|
arr = ["true", "false"]
|
|
@admin_select = @user.admin ? arr : arr.reverse
|
|
end
|
|
|
|
def update_user
|
|
user = User.find_by_id(params[:admin_id])
|
|
if user
|
|
# VULNERABILITY: Using params[:user] directly without strong parameters
|
|
# This allows mass assignment of any user attribute including 'admin'
|
|
# See wiki: Extras:-Mass-Assignment-Admin-Role.md
|
|
user_params = params[:user].to_unsafe_h if params[:user].respond_to?(:to_unsafe_h)
|
|
user_params ||= params[:user]
|
|
|
|
# Filter out password fields if blank to avoid validation errors
|
|
filtered_params = user_params.reject { |k, v| (k == "password" || k == "password_confirmation") && v.blank? }
|
|
|
|
user.update(filtered_params)
|
|
user.save!
|
|
flash[:success] = "User updated successfully"
|
|
redirect_to admin_get_all_users_path(current_user.id)
|
|
else
|
|
flash[:error] = "User not found"
|
|
redirect_to admin_get_all_users_path(current_user.id)
|
|
end
|
|
end
|
|
|
|
def delete_user
|
|
user = User.find_by(id: params[:admin_id])
|
|
if user && !(current_user.id == user.id)
|
|
# Call destroy here so that all association records w/ id are destroyed as well
|
|
# Example user.retirement records would be destroyed
|
|
user.destroy
|
|
flash[:success] = "User deleted successfully"
|
|
else
|
|
flash[:error] = "Cannot delete this user"
|
|
end
|
|
redirect_to admin_get_all_users_path(current_user.id)
|
|
end
|
|
|
|
private
|
|
|
|
def custom_fields
|
|
params.require(:field).keys
|
|
end
|
|
helper_method :custom_fields
|
|
|
|
def admin_param
|
|
params[:admin_id] != "1"
|
|
end
|
|
end
|