diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml index a91f2ae9..f14cfb99 100644 --- a/.rubocop_todo.yml +++ b/.rubocop_todo.yml @@ -1,6 +1,6 @@ # This configuration was generated by # `rubocop --auto-gen-config` -# on 2017-07-14 12:03:16 +0000 using RuboCop version 0.49.1. +# on 2017-11-27 22:40:12 +0530 using RuboCop version 0.51.0. # The point is for the user to remove these configuration records # one by one as the offenses are removed from the code base. # Note that changes in the inspected code, or installation of new @@ -46,7 +46,7 @@ Layout/EmptyLineAfterMagicComment: Exclude: - 'spec/models/conference_spec.rb' -# Offense count: 104 +# Offense count: 109 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, SupportedStyles. # SupportedStyles: empty_lines, no_empty_lines @@ -151,7 +151,7 @@ Layout/MultilineHashBraceLayout: Layout/MultilineMethodCallBraceLayout: Enabled: false -# Offense count: 55 +# Offense count: 53 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth. # SupportedStyles: aligned, indented, indented_relative_to_receiver @@ -192,10 +192,11 @@ Layout/SpaceAroundOperators: Exclude: - 'lib/tasks/data.rake' -# Offense count: 416 +# Offense count: 463 # Cop supports --auto-correct. -# Configuration parameters: EnforcedStyle, SupportedStyles. +# Configuration parameters: EnforcedStyle, SupportedStyles, SupportedStylesForEmptyBraces. # SupportedStyles: space, no_space +# SupportedStylesForEmptyBraces: space, no_space Layout/SpaceBeforeBlockBraces: Enabled: false @@ -205,20 +206,13 @@ Layout/SpaceBeforeComma: Exclude: - 'lib/tasks/data_demo.rake' -# Offense count: 1 -# Cop supports --auto-correct. -# Configuration parameters: AllowForAlignment. -Layout/SpaceBeforeFirstArg: - Exclude: - - 'spec/controllers/admin/roles_controller_spec.rb' - # Offense count: 1 # Cop supports --auto-correct. Layout/SpaceBeforeSemicolon: Exclude: - 'Guardfile' -# Offense count: 51 +# Offense count: 54 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, SupportedStyles, EnforcedStyleForEmptyBraces, SupportedStylesForEmptyBraces, SpaceBeforeBlockParameters. # SupportedStyles: space, no_space @@ -293,6 +287,13 @@ Lint/IneffectiveAccessModifier: - 'app/models/conference.rb' # Offense count: 2 +Lint/RescueWithoutErrorClass: + Exclude: + - 'app/controllers/users/omniauth_callbacks_controller.rb' + - 'lib/tasks/migrate_config.rake' + +# Offense count: 2 +# Cop supports --auto-correct. Lint/ScriptPermission: Exclude: - 'Guardfile' @@ -305,49 +306,41 @@ Lint/UnusedBlockArgument: Exclude: - 'lib/tasks/user.rake' -# Offense count: 114 +# Offense count: 136 Metrics/AbcSize: Max: 86 -# Offense count: 233 +# Offense count: 258 # Configuration parameters: CountComments, ExcludedMethods. Metrics/BlockLength: Max: 471 -# Offense count: 23 +# Offense count: 28 Metrics/CyclomaticComplexity: - Max: 12 - Exclude: - - 'app/models/track.rb' + Max: 14 -# Offense count: 2353 +# Offense count: 2774 # Configuration parameters: AllowHeredoc, AllowURI, URISchemes, IgnoreCopDirectives, IgnoredPatterns. # URISchemes: http, https Metrics/LineLength: Max: 619 -# Offense count: 120 +# Offense count: 133 # Configuration parameters: CountComments. Metrics/MethodLength: Max: 56 - Exclude: - - 'app/models/admin_ability.rb' -# Offense count: 3 +# Offense count: 4 # Configuration parameters: CountComments. Metrics/ModuleLength: - Max: 159 - Exclude: - - 'app/helpers/format_helper.rb' - -# Offense count: 15 -Metrics/PerceivedComplexity: - Max: 16 - Exclude: - - 'app/models/track.rb' + Max: 171 # Offense count: 20 -Style/AccessorMethodName: +Metrics/PerceivedComplexity: + Max: 16 + +# Offense count: 20 +Naming/AccessorMethodName: Exclude: - 'app/controllers/admin/events_controller.rb' - 'app/controllers/application_controller.rb' @@ -356,6 +349,51 @@ Style/AccessorMethodName: - 'app/models/target.rb' - 'app/models/user.rb' +# Offense count: 2 +# Configuration parameters: ExpectMatchingDefinition, Regex, IgnoreExecutableScripts, AllowedAcronyms. +# AllowedAcronyms: CLI, DSL, ACL, API, ASCII, CPU, CSS, DNS, EOF, GUID, HTML, HTTP, HTTPS, ID, IP, JSON, LHS, QPS, RAM, RHS, RPC, SLA, SMTP, SQL, SSH, TCP, TLS, TTL, UDP, UI, UID, UUID, URI, URL, UTF8, VM, XML, XMPP, XSRF, XSS +Naming/FileName: + Exclude: + - 'Gemfile' + - 'Vagrantfile' + +# Offense count: 2 +# Configuration parameters: Blacklist. +# Blacklist: END, (?-mix:EO[A-Z]{1}) +Naming/HeredocDelimiterNaming: + Exclude: + - 'spec/factories/users.rb' + - 'spec/models/user_spec.rb' + +# Offense count: 2 +# Configuration parameters: NamePrefix, NamePrefixBlacklist, NameWhitelist, MethodDefinitionMacros. +# NamePrefix: is_, has_, have_ +# NamePrefixBlacklist: is_, has_, have_ +# NameWhitelist: is_a? +# MethodDefinitionMacros: define_method, define_singleton_method +Naming/PredicateName: + Exclude: + - 'spec/**/*' + - 'app/models/comment.rb' + - 'app/models/contact.rb' + +# Offense count: 2 +# Configuration parameters: EnforcedStyle, SupportedStyles. +# SupportedStyles: snake_case, normalcase, non_integer +Naming/VariableNumber: + Exclude: + - 'spec/models/ticket_purchase_spec.rb' + +# Offense count: 4 +# Cop supports --auto-correct. +# Configuration parameters: AutoCorrect. +Performance/HashEachMethods: + Exclude: + - 'app/controllers/admin/conferences_controller.rb' + - 'app/helpers/application_helper.rb' + - 'db/migrate/20140701123203_add_events_per_week_to_conference.rb' + - 'spec/factories/event_users.rb' + # Offense count: 1 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, SupportedStyles. @@ -386,7 +424,14 @@ Style/ConditionalAssignment: - 'db/migrate/20140610165551_migrate_data_person_to_user.rb' - 'db/migrate/20140820124117_undo_wrong_migration20140801080705_add_users_to_events.rb' -# Offense count: 464 +# Offense count: 9 +Style/DateTime: + Exclude: + - 'app/models/conference.rb' + - 'app/models/program.rb' + - 'spec/models/conference_spec.rb' + +# Offense count: 488 Style/Documentation: Enabled: false @@ -419,14 +464,13 @@ Style/EmptyMethod: - 'db/migrate/20130216122155_set_registration_defaults_to_false.rb' # Offense count: 2 -# Configuration parameters: ExpectMatchingDefinition, Regex, IgnoreExecutableScripts, AllowedAcronyms. -# AllowedAcronyms: CLI, DSL, ACL, API, ASCII, CPU, CSS, DNS, EOF, GUID, HTML, HTTP, HTTPS, ID, IP, JSON, LHS, QPS, RAM, RHS, RPC, SLA, SMTP, SQL, SSH, TCP, TLS, TTL, UDP, UI, UID, UUID, URI, URL, UTF8, VM, XML, XMPP, XSRF, XSS -Style/FileName: +# Cop supports --auto-correct. +Style/Encoding: Exclude: - - 'Gemfile' - - 'Vagrantfile' + - 'app/uploaders/picture_uploader.rb' + - 'spec/models/conference_spec.rb' -# Offense count: 24 +# Offense count: 32 # Configuration parameters: MinBodyLength. Style/GuardClause: Enabled: false @@ -445,7 +489,6 @@ Style/HashSyntax: # Configuration parameters: MaxLineLength. Style/IfUnlessModifier: Exclude: - - 'app/controllers/admin/booths_controller.rb' - 'app/controllers/admin/events_controller.rb' - 'app/controllers/api/v1/events_controller.rb' - 'app/controllers/conference_registrations_controller.rb' @@ -454,7 +497,6 @@ Style/IfUnlessModifier: - 'app/models/commercial.rb' - 'app/models/conference.rb' - 'app/models/email_settings.rb' - - 'app/models/ticket_purchase.rb' - 'app/models/user.rb' - 'db/migrate/20151031092713_change_conference_id_to_venue_id_in_rooms.rb' - 'lib/tasks/events_registrations.rake' @@ -469,7 +511,7 @@ Style/LineEndConcatenation: - 'spec/features/conference_spec.rb' - 'spec/features/registration_periods_spec.rb' -# Offense count: 6 +# Offense count: 9 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, SupportedStyles. # SupportedStyles: require_parentheses, require_no_parentheses, require_no_parentheses_except_multiline @@ -498,12 +540,14 @@ Style/MutableConstant: # Offense count: 4 # Cop supports --auto-correct. +# Configuration parameters: Whitelist. +# Whitelist: be, be_a, be_an, be_between, be_falsey, be_kind_of, be_instance_of, be_truthy, be_within, eq, eql, end_with, include, match, raise_error, respond_to, start_with Style/NestedParenthesizedCalls: Exclude: - 'spec/features/conference_spec.rb' - 'spec/models/conference_spec.rb' -# Offense count: 26 +# Offense count: 27 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, MinBodyLength, SupportedStyles. # SupportedStyles: skip_modifier_ifs, always @@ -548,6 +592,12 @@ Style/OptionalArguments: Exclude: - 'app/models/event.rb' +# Offense count: 1 +# Cop supports --auto-correct. +Style/OrAssignment: + Exclude: + - 'app/controllers/schedules_controller.rb' + # Offense count: 3 # Cop supports --auto-correct. # Configuration parameters: AllowSafeAssignment. @@ -557,7 +607,7 @@ Style/ParenthesesAroundCondition: - 'app/controllers/application_controller.rb' - 'app/helpers/format_helper.rb' -# Offense count: 14 +# Offense count: 15 # Cop supports --auto-correct. # Configuration parameters: PreferredDelimiters. Style/PercentLiteralDelimiters: @@ -571,20 +621,9 @@ Style/PercentLiteralDelimiters: - 'app/models/contact.rb' - 'app/models/registration.rb' - 'app/models/subscription.rb' + - 'app/models/track.rb' - 'app/uploaders/picture_uploader.rb' - 'spec/models/program_spec.rb' - - 'app/models/track.rb' - -# Offense count: 2 -# Configuration parameters: NamePrefix, NamePrefixBlacklist, NameWhitelist. -# NamePrefix: is_, has_, have_ -# NamePrefixBlacklist: is_, has_, have_ -# NameWhitelist: is_a? -Style/PredicateName: - Exclude: - - 'spec/**/*' - - 'app/models/comment.rb' - - 'app/models/contact.rb' # Offense count: 1 # Cop supports --auto-correct. @@ -662,7 +701,7 @@ Style/StringLiteralsInInterpolation: Exclude: - 'lib/tasks/dump_db.rake' -# Offense count: 73 +# Offense count: 79 # Cop supports --auto-correct. # Configuration parameters: EnforcedStyle, MinSize, SupportedStyles. # SupportedStyles: percent, brackets @@ -708,10 +747,3 @@ Style/UnneededInterpolation: Exclude: - 'app/helpers/format_helper.rb' - 'spec/controllers/admin/conferences_controller_spec.rb' - -# Offense count: 2 -# Configuration parameters: EnforcedStyle, SupportedStyles. -# SupportedStyles: snake_case, normalcase, non_integer -Style/VariableNumber: - Exclude: - - 'spec/models/ticket_purchase_spec.rb' diff --git a/.travis.yml b/.travis.yml index 6650fbf9..88c50189 100644 --- a/.travis.yml +++ b/.travis.yml @@ -22,7 +22,7 @@ before_script: - cp config/database.yml.travis config/database.yml - cp config/secrets.yml.example config/secrets.yml - mysql -u root -e 'create database osem_test;' - - RAILS_ENV=test bundle exec rake db:migrate --trace + - RAILS_ENV=test bundle exec rake db:schema:load --trace script: - "./travis_script.sh $TEST_SUITE" env: diff --git a/Gemfile b/Gemfile index 22dc5f6e..d4e3f517 100644 --- a/Gemfile +++ b/Gemfile @@ -44,6 +44,9 @@ gem 'omniauth-openid' gem 'omniauth-google-oauth2' gem 'omniauth-github' +# Bot-filtering +gem 'recaptcha', require: 'recaptcha/rails' + # as authorization framework gem 'cancancan' @@ -182,6 +185,10 @@ gem 'cloudinary' # for setting app configuration in the environment gem 'dotenv-rails' +# configurable toggles for functionality +# https://github.com/mgsnova/feature +gem 'feature' + # For countable.js gem "countable-rails", "~> 0.0.1" @@ -212,7 +219,7 @@ group :development do gem 'spring-commands-rspec' gem 'haml_lint', '~> 0.24.0' # for static code analisys - gem 'rubocop', '~> 0.49.0', require: false + gem 'rubocop', '~> 0.51.0', require: false # as database gem 'sqlite3' # to open mails diff --git a/Gemfile.lock b/Gemfile.lock index dc730e82..eb9eed9e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -179,6 +179,7 @@ GEM multipart-post (>= 1.2, < 3) fastimage (2.0.0) addressable (~> 2) + feature (1.4.0) ffi (1.9.18) font-awesome-rails (4.7.0.2) railties (>= 3.2, < 5.2) @@ -324,9 +325,9 @@ GEM activerecord (>= 3.0, < 6.0) activesupport (>= 3.0, < 6.0) request_store (~> 1.1) - parallel (1.11.2) - parser (2.4.0.0) - ast (~> 2.2) + parallel (1.12.0) + parser (2.4.0.2) + ast (~> 2.3) pdf-core (0.2.5) phantomjs (2.1.1.0) piwik_analytics (1.0.2) @@ -410,7 +411,7 @@ GEM thor (>= 0.18.1, < 2.0) rainbow (2.2.2) rake - rake (12.0.0) + rake (12.3.0) rb-fsevent (0.10.2) rb-inotify (0.9.10) ffi (>= 0.5.0, < 2) @@ -420,6 +421,8 @@ GEM loggability (~> 0.12) rdoc (~> 5.0) yajl-ruby (~> 1.3) + recaptcha (4.6.2) + json redcarpet (3.2.3) referer-parser (0.2.1) request_store (1.1.0) @@ -458,16 +461,16 @@ GEM rspec-mocks (~> 3.6.0) rspec-support (~> 3.6.0) rspec-support (3.6.0) - rubocop (0.49.1) + rubocop (0.51.0) parallel (~> 1.10) parser (>= 2.3.3.1, < 3.0) powerpack (~> 0.1) - rainbow (>= 1.99.1, < 3.0) + rainbow (>= 2.2.2, < 3.0) ruby-progressbar (~> 1.7) unicode-display_width (~> 1.0, >= 1.0.1) ruby-oembed (0.8.14) ruby-openid (2.5.0) - ruby-progressbar (1.8.1) + ruby-progressbar (1.9.0) ruby_dep (1.5.0) rubyzip (1.2.1) safe_yaml (1.0.4) @@ -552,7 +555,7 @@ GEM chronic (>= 0.6.3) xpath (2.0.0) nokogiri (~> 1.3) - yajl-ruby (1.3.0) + yajl-ruby (1.3.1) PLATFORMS ruby @@ -589,6 +592,7 @@ DEPENDENCIES dotenv-rails factory_girl_rails faker + feature font-awesome-rails formtastic (~> 3.1.1) formtastic-bootstrap @@ -636,13 +640,14 @@ DEPENDENCIES rails-i18n (~> 4.0.0) rails_12factor rdoc-generator-fivefish + recaptcha redcarpet responders (~> 2.0) rolify rqrcode rspec-activemodel-mocks rspec-rails (~> 3.5, >= 3.5.2) - rubocop (~> 0.49.0) + rubocop (~> 0.51.0) ruby-oembed sass-rails (>= 4.0.2) selectize-rails @@ -663,4 +668,4 @@ DEPENDENCIES whenever BUNDLED WITH - 1.15.4 + 1.16.0 diff --git a/app/assets/stylesheets/osem.css.scss b/app/assets/stylesheets/osem.css.scss index 79768c5d..bbcabc44 100644 --- a/app/assets/stylesheets/osem.css.scss +++ b/app/assets/stylesheets/osem.css.scss @@ -1,3 +1,5 @@ +@import "bootstrap/mixins"; + html { position: relative; min-height: 100%; @@ -104,3 +106,12 @@ p.comment-body { .qr-image{ margin-left: 120px; } + +.g-recaptcha { + @include clearfix; + padding-bottom: 12px; + + div { + float: right; + } +} diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb index e141084c..e020d217 100644 --- a/app/controllers/registrations_controller.rb +++ b/app/controllers/registrations_controller.rb @@ -1,5 +1,5 @@ class RegistrationsController < Devise::RegistrationsController - before_action :configure_permitted_parameters, if: :devise_controller? + prepend_before_action :check_captcha, only: [:create] def edit @openids = Openid.where(user_id: current_user.id).order(:provider) @@ -21,14 +21,34 @@ class RegistrationsController < Devise::RegistrationsController edit_user_registration_path(resource) end - def configure_permitted_parameters - devise_parameter_sanitizer.permit(:account_update) do |u| - u - .permit(:email, :password, :password_confirmation, :current_password, :username, :email_public) - end - devise_parameter_sanitizer.permit(:sign_up) do |u| - u - .permit(:email, :password, :password_confirmation, :name, :username) + private + + def sign_up_params + params.require(:user).permit( + :email, + :password, + :password_confirmation, + :name, + :username + ) + end + + def account_update_params + params.require(:user).permit( + :email, + :password, + :password_confirmation, + :current_password, + :username, + :email_public + ) + end + + def check_captcha + unless Feature.inactive?(:recaptcha) || verify_recaptcha + self.resource = resource_class.new sign_up_params + resource.validate # Look for any other validation errors besides Recaptcha + respond_with_navigational(resource) { render :new } end end end diff --git a/app/models/ticket.rb b/app/models/ticket.rb index 13646c9f..97a3089b 100644 --- a/app/models/ticket.rb +++ b/app/models/ticket.rb @@ -61,7 +61,7 @@ class Ticket < ActiveRecord::Base end def tickets_turnover_total(id) - tickets = TicketPurchase.where(ticket_id: id) + tickets = TicketPurchase.where(ticket_id: id).paid tickets.inject(0){ |sum, ticket| sum + (ticket.amount_paid * ticket.quantity) } end diff --git a/app/views/devise/registrations/new.html.haml b/app/views/devise/registrations/new.html.haml index aa9c4db4..64aaa99e 100644 --- a/app/views/devise/registrations/new.html.haml +++ b/app/views/devise/registrations/new.html.haml @@ -12,6 +12,8 @@ = f.input :name, input_html: { required: true }, hint: 'This is your real name' = f.input :password, input_html: { required: true } = f.input :password_confirmation, input_html: { required: true } + - Feature.with(:recaptcha) do + = recaptcha_tags %p.text-right = f.action :submit, as: :button, label: 'Sign Up', button_html: { class: 'btn btn-success' } diff --git a/config/environments/production.rb b/config/environments/production.rb index 4e2c2e79..a70ef729 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -33,7 +33,7 @@ Osem::Application.configure do # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. - # config.force_ssl = true + config.force_ssl = !!ENV['FORCE_SSL'] # See everything in the log (default is :info) config.log_level = :info diff --git a/config/initializers/feature.rb b/config/initializers/feature.rb new file mode 100644 index 00000000..415d84f7 --- /dev/null +++ b/config/initializers/feature.rb @@ -0,0 +1,10 @@ +require 'feature' + +repo = Feature::Repository::SimpleRepository.new + +# configure features here +unless(ENV['RECAPTCHA_SITE_KEY'].blank? || ENV['RECAPTCHA_SECRET_KEY'].blank?) + repo.add_active_feature :recaptcha +end + +Feature.set_repository repo diff --git a/db/schema.rb b/db/schema.rb index bdf3ad65..ea1e3dd7 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -505,7 +505,7 @@ ActiveRecord::Schema.define(version: 20170924190528) do t.integer "user_id" t.integer "payment_id" t.integer "week" - t.float "amount_paid" + t.float "amount_paid", default: 0.0 end create_table "ticket_scannings", force: :cascade do |t| @@ -579,7 +579,6 @@ ActiveRecord::Schema.define(version: 20170924190528) do t.boolean "is_admin", default: false t.string "username" t.boolean "is_disabled", default: false - t.string "token" end add_index "users", ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true diff --git a/docker-compose.env.example b/docker-compose.env.example index 2aedbe73..905ff612 100644 --- a/docker-compose.env.example +++ b/docker-compose.env.example @@ -19,10 +19,10 @@ DATABASE_PORT=3306 # having to create a .env file: # https://github.com/openSUSE/osem/blob/master/dotenv.example -OSEM_NAME=Dockerized OSEM -OSEM_HOSTNAME=http://localhost:9292 -OSEM_ERRBIT_HOST=localhost -SECRET_KEY_BASE=changemechangemechangeme +OSEM_NAME="Dockerized OSEM" +OSEM_HOSTNAME="http://localhost:9292" +OSEM_ERRBIT_HOST="localhost" +SECRET_KEY_BASE=changemechangemechangeme" # these settings work for the MailHog server that is enabled by default in # docker-compose.yml @@ -31,9 +31,10 @@ SECRET_KEY_BASE=changemechangemechangeme # your users are going to see the HTTP status 500 page # you should comment out or remove the mailhog service from docker-compose.yml, # too -OSEM_EMAIL_ADDRESS=osem@mailhog -OSEM_SMTP_AUTHENTICATION=login -OSEM_SMTP_ADDRESS=mailhog -OSEM_SMTP_PORT=1025 -OSEM_SMTP_USERNAME=mailhog -OSEM_SMTP_PASSWORD=mailhog +OSEM_EMAIL_ADDRESS="osem@mailhog" +OSEM_SMTP_AUTHENTICATION="login" +OSEM_SMTP_ADDRESS="mailhog" +OSEM_SMTP_PORT="1025" +OSEM_SMTP_USERNAME="mailhog" +OSEM_SMTP_PASSWORD="mailhog" + diff --git a/dotenv.example b/dotenv.example index 77c28e4c..a5622a4c 100644 --- a/dotenv.example +++ b/dotenv.example @@ -63,3 +63,10 @@ OSEM_SMTP_OPENSSL_VERIFY_MODE="" # Enable the usage of the devise ichain plugin OSEM_ICHAIN_ENABLED=false + +# enable this to force SSL +# FORCE_SSL="1" + +# ReCAPTCHA keys +RECAPTCHA_SITE_KEY="" +RECAPTCHA_SECRET_KEY=""