From d6bda2f6dc33b4bb79d6c1ea27c82e319327886f Mon Sep 17 00:00:00 2001
From: Matt Barringer <mbarringer@suse.de>
Date: Wed, 6 Feb 2013 07:23:35 +0100
Subject: [PATCH] Reject supporter codes if they're already used by another
 email

---
 .../admin/supporters_controller.rb            |  1 -
 .../conference_registration_controller.rb     | 27 ++++++++++++++++++-
 app/controllers/registrations_controller.rb   | 10 ++++++-
 app/models/datatable_supporters.rb            | 14 ++++++++--
 4 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/supporters_controller.rb b/app/controllers/admin/supporters_controller.rb
index 122f5c63..12f24b25 100644
--- a/app/controllers/admin/supporters_controller.rb
+++ b/app/controllers/admin/supporters_controller.rb
@@ -14,6 +14,5 @@ class Admin::SupportersController < ApplicationController
     supporter = SupporterRegistration.create!(params[:supporter_registration])
     flash[:notice] = "Supporter added"
     render :json => {"status" => "ok"}
-
   end
 end
diff --git a/app/controllers/conference_registration_controller.rb b/app/controllers/conference_registration_controller.rb
index 93741897..6c5184e7 100644
--- a/app/controllers/conference_registration_controller.rb
+++ b/app/controllers/conference_registration_controller.rb
@@ -12,6 +12,8 @@ class ConferenceRegistrationController < ApplicationController
       @registration = @person.registrations.new(:conference_id => @conference.id)
     end
 
+    # Check if there's an existing SupporterRegistration for this email and link it when appropriate
+    @registration.supporter_registration ||= @conference.supporter_registrations.where(:email => @person.email).first
     @registration.supporter_registration ||= SupporterRegistration.new(:conference_id => @conference.id)
   end
 
@@ -21,19 +23,42 @@ class ConferenceRegistrationController < ApplicationController
     person = current_user.person
     registration = person.registrations.where(:conference_id => conference.id).first
     update_registration = true
+    # First verify that the supporter code is legit
+    if !params[:registration][:supporter_registration_attributes].nil? && !params[:registration][:supporter_registration_attributes][:code].empty?
+      regs = conference.supporter_registrations.where(:code => params[:registration][:supporter_registration_attributes][:code])
+
+      if regs.count != 0
+        if regs.where(:email => person.email).count == 0
+          redirect_to(register_conference_path(:id => conference.short_title), :alert => "This code is already in use.  Please contact #{conference.contact_email} for assistance.")
+          return
+        end
+      end
+    end
     begin
       if registration.nil?
         update_registration = false
         person.update_attributes(params[:registration][:person_attributes])
         params[:registration].delete :person_attributes
-        params[:registration][:supporter_registration_attributes]["conference_id"] = conference.id
+        supporter_reg = params[:registration][:supporter_registration_attributes]
+        params[:registration].delete :supporter_registration_attributes
         registration = person.registrations.new(params[:registration])
+        if !supporter_reg[:id].blank?
+          # This means that their supporter registration was entered ahead of time, probably by an admin
+          registration.supporter_registration = SupporterRegistration.find(supporter_reg[:id])
+          if registration.supporter_registration.email != person.email
+            raise "Invalid code"
+          end
+        else
+          registration.supporter_registration = conference.supporter_registrations.new(supporter_reg)
+        end
+
         registration.conference_id = conference.id
         registration.save!
       else
         registration.update_attributes!(params[:registration])
       end
     rescue Exception => e
+      Rails.logger.debug e.backtrace.join("\n")
       redirect_to(register_conference_path(:id => conference.short_title), :alert => 'Registration failed:' + e.message)
       return
     end
diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 04828917..9b43a88f 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -24,11 +24,19 @@ class RegistrationsController < Devise::RegistrationsController
     if email_changed or password_changed
       successfully_updated = @user.update_with_password(params[:user])
     else
+      params[:user].delete :current_password
       successfully_updated = @user.update_without_password(params[:user])
     end
 
     if successfully_updated
-      set_flash_message :notice, :updated
+      if email_changed
+        if !@user.person.nil?
+          @user.person.update_attribute("email", params[:user][:email])
+        end
+        set_flash_message :notice, :update_needs_confirmation
+      else
+        set_flash_message :notice, :updated
+      end
       # Sign in the user bypassing validation in case his password changed
       sign_in @user, :bypass => true
       redirect_to after_update_path_for(@user)
diff --git a/app/models/datatable_supporters.rb b/app/models/datatable_supporters.rb
index cf72860c..5c762c59 100644
--- a/app/models/datatable_supporters.rb
+++ b/app/models/datatable_supporters.rb
@@ -4,13 +4,23 @@ class DatatableSupporters < Datatable
     items.each do |i|
       item = []
       if i.name.blank?
-        item << i.registration.person.public_name
+        if !i.registration.nil? && !i.registration.person.nil?
+          item << i.registration.person.public_name
+        else
+          item << "Unknown"
+        end
+
       else
         item << i.name
       end
 
       if i.email.blank?
-        item << i.registration.person.email
+        if !i.registration.nil? && !i.registration.person.nil?
+          item << i.registration.person.email
+        else
+          item << "Unknown"
+        end
+
       else
         item << i.email
       end