Skip to content

Commit

Permalink
Tweaks around serializability
Browse files Browse the repository at this point in the history
String keys, Strings instead of Class names.
  • Loading branch information
atz committed Jan 13, 2017
1 parent 98262a5 commit 94f1fa6
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 10 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ module BatchUploadsControllerBehavior
# @note we don't call `authorize!` directly, since `authorized_models` already checks `user.can? :create, ...`
def create
authenticate_user!
unsafe_pc = params[:batch_upload_item][:payload_concern]
unsafe_pc = params.fetch(:batch_upload_item, {})[:payload_concern]
# Calling constantize on user params is disfavored (per brakeman), so we sanitize by matching it against an authorized model.
safe_pc = Sufia::SelectTypeListPresenter.new(current_user).authorized_models.map(&:to_s).find { |x| x == unsafe_pc }
raise CanCan::AccessDenied, "Cannot create an object of class '#{unsafe_pc}'" unless safe_pc
authorize! :create, safe_pc
create_update_job(safe_pc.constantize)
# authorize! :create, safe_pc
create_update_job(safe_pc)
flash[:notice] = t('sufia.works.new.after_create_html', application_name: view_context.application_name)
redirect_after_update
end
Expand All @@ -47,7 +47,8 @@ def redirect_after_update
end
end

# @param [Class] klass the Sufia Work Class being created by the batch
# @param [String] klass the name of the Sufia Work Class being created by the batch
# @note Cannot use a proper Class here because it won't serialize
def create_update_job(klass)
log = BatchCreateOperation.create!(user: current_user,
operation_type: "Batch Create")
Expand Down
12 changes: 6 additions & 6 deletions app/jobs/batch_create_job.rb
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@ class BatchCreateJob < ActiveJob::Base
# This copies metadata from the passed in attribute to all of the works that
# are members of the given upload set
# @param [User] user
# @param [Array<String>] titles
# @param [Array<String>] resource_types
# @param [Array<Sufia::UploadedFile>] uploaded_files
# @param [Hash] attributes attributes to apply to all works
# @param [Hash<String => String>] titles
# @param [Hash<String => String>] resource_types
# @param [Array<String>] uploaded_files Sufia::UploadedFile IDs
# @param [Hash] attributes attributes to apply to all works, including :model
# @param [BatchCreateOperation] log
def perform(user, titles, resource_types, uploaded_files, attributes, log)
log.performing!
Expand All @@ -25,13 +25,13 @@ def perform(user, titles, resource_types, uploaded_files, attributes, log)

def create(user, titles, resource_types, uploaded_files, attributes, log)
uploaded_files.each do |upload_id|
model = attributes.delete(:model) || attributes.delete('model')
raise ArgumentError, 'attributes must include "model" => ClassName.to_s' unless model
title = [titles[upload_id]] if titles[upload_id]
resource_type = [resource_types[upload_id]] if resource_types[upload_id]
attributes = attributes.merge(uploaded_files: [upload_id],
title: title,
resource_type: resource_type)
model = attributes.delete(:model)
raise ArgumentError, "attributes must include :model" unless model
child_log = CurationConcerns::Operation.create!(user: user,
operation_type: "Create Work",
parent: log)
Expand Down

0 comments on commit 94f1fa6

Please sign in to comment.