From b69cd9df2abd1e291471102846dad2c1268ebae8 Mon Sep 17 00:00:00 2001 From: Linus Gasser Date: Mon, 13 Oct 2025 13:29:17 +0200 Subject: [PATCH] Don't send emails in cookies --- app/controllers/admin/emails_controller.rb | 66 +++++++++++++++++-- .../admin/emails/_bulk_compose.html.haml | 8 ++- .../admin/emails/_bulk_recipients.html.haml | 3 +- config/routes.rb | 1 + 4 files changed, 69 insertions(+), 9 deletions(-) diff --git a/app/controllers/admin/emails_controller.rb b/app/controllers/admin/emails_controller.rb index c5c1576d..d407a321 100644 --- a/app/controllers/admin/emails_controller.rb +++ b/app/controllers/admin/emails_controller.rb @@ -35,9 +35,23 @@ module Admin @filter_type = params[:filter_type] @search_term = params[:search_term] when 'compose' - @recipient_emails = params[:recipient_emails] || [] - @filter_type = params[:filter_type] - @search_term = params[:search_term] + if params[:bulk_session_token] + @bulk_session = BulkEmailSession.active.find_by(token: params[:bulk_session_token]) + if @bulk_session && !@bulk_session.expired? + @recipient_emails = @bulk_session.recipient_emails + @filter_type = @bulk_session.filter_type + @search_term = @bulk_session.search_term + else + redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'filter'), + alert: 'Bulk email session expired. Please start again.' + return + end + else + # Fallback to old method for backward compatibility + @recipient_emails = params[:recipient_emails] || [] + @filter_type = params[:filter_type] + @search_term = params[:search_term] + end end end @@ -58,12 +72,53 @@ module Admin } end + def create_bulk_session + authorize! :index, @conference.email_settings + + recipient_emails = params[:recipient_emails] || [] + filter_type = params[:filter_type] + search_term = params[:search_term] + + if recipient_emails.empty? + redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients', + filter_type: filter_type, search_term: search_term), + alert: 'No recipients selected.' + return + end + + # Clean up any expired sessions + BulkEmailSession.cleanup_expired! + + # Create new session + @bulk_session = BulkEmailSession.create!( + recipient_emails: recipient_emails, + filter_type: filter_type, + search_term: search_term + ) + + redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'compose', + bulk_session_token: @bulk_session.token) + end + def send_bulk authorize! :index, @conference.email_settings subject = params[:subject] body = params[:body] - recipient_emails = params[:recipient_emails] || [] + + # Get recipient emails from either bulk session or direct params + if params[:bulk_session_token] + bulk_session = BulkEmailSession.active.find_by(token: params[:bulk_session_token]) + if bulk_session && !bulk_session.expired? + recipient_emails = bulk_session.recipient_emails + else + redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'filter'), + alert: 'Bulk email session expired. Please start again.' + return + end + else + recipient_emails = params[:recipient_emails] || [] + end if subject.blank? || body.blank? redirect_to bulk_admin_conference_emails_path(@conference.short_title, step: 'compose'), @@ -84,6 +139,9 @@ module Admin Rails.logger.info "Bulk email queued - Subject: '#{subject}' - Recipient: #{user.email}" end + # Clean up the bulk session after use + bulk_session&.destroy + redirect_to admin_conference_emails_path(@conference.short_title), notice: "Bulk email sent to #{recipients.count} recipients." end diff --git a/app/views/admin/emails/_bulk_compose.html.haml b/app/views/admin/emails/_bulk_compose.html.haml index 1f44753f..a16cfc4c 100644 --- a/app/views/admin/emails/_bulk_compose.html.haml +++ b/app/views/admin/emails/_bulk_compose.html.haml @@ -3,8 +3,10 @@ %h3 Step 3: Compose Email = form_tag send_bulk_admin_conference_emails_path(@conference.short_title), method: :post, class: 'form-horizontal' do - - @recipient_emails.each do |email| - = hidden_field_tag 'recipient_emails[]', email + = hidden_field_tag :bulk_session_token, params[:bulk_session_token] if params[:bulk_session_token] + - if !params[:bulk_session_token] && @recipient_emails + - @recipient_emails.each do |email| + = hidden_field_tag 'recipient_emails[]', email .form-group = label_tag :subject, 'Subject', class: 'col-sm-2 control-label' @@ -26,7 +28,7 @@ .form-group .col-sm-offset-2.col-sm-10 = submit_tag 'Send Bulk Email', class: 'btn btn-success btn-lg', data: { confirm: "Are you sure you want to send this email to #{@recipient_emails.count} recipients?" } - = link_to 'Back to Recipients', bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients', filter_type: params[:filter_type], search_term: params[:search_term]), class: 'btn btn-default' + = link_to 'Back to Recipients', bulk_admin_conference_emails_path(@conference.short_title, step: 'recipients', filter_type: @filter_type, search_term: @search_term), class: 'btn btn-default' = link_to 'Cancel', admin_conference_emails_path(@conference.short_title), class: 'btn btn-default' .col-md-4 diff --git a/app/views/admin/emails/_bulk_recipients.html.haml b/app/views/admin/emails/_bulk_recipients.html.haml index 3c797a14..a9594866 100644 --- a/app/views/admin/emails/_bulk_recipients.html.haml +++ b/app/views/admin/emails/_bulk_recipients.html.haml @@ -6,8 +6,7 @@ %strong= @selected_recipients.count recipients matching your filter criteria. Select the recipients you want to email: - = form_tag bulk_admin_conference_emails_path(@conference.short_title), method: :get, id: 'recipients-form' do - = hidden_field_tag :step, 'compose' + = form_tag create_bulk_session_admin_conference_emails_path(@conference.short_title), method: :post, id: 'recipients-form' do = hidden_field_tag :filter_type, @filter_type = hidden_field_tag :search_term, @search_term diff --git a/config/routes.rb b/config/routes.rb index ce151371..9f78e1c3 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -119,6 +119,7 @@ Osem::Application.routes.draw do collection do get :bulk get :recipients + post :create_bulk_session post :send_bulk end end