Sign upLogin

expertiza/expertiza

View on GitHub
Star
app/controllers/users_controller.rb

Summary

Maintainability
A
50 mins
Test Coverage
F
0%

Parameters should be whitelisted for mass assignment
Open

    params.permit!
Severity: Critical
Found in app/controllers/users_controller.rb by brakeman

Mass assignment is a feature of Rails which allows an application to create a record from the values of a hash.

Example:

User.new(params[:user])

Unfortunately, if there is a user field called admin which controls administrator access, now any user can make themselves an administrator.

attr_accessible and attr_protected can be used to limit mass assignment. However, Brakeman will warn unless attr_accessible is used, or mass assignment is completely disabled.

There are two different mass assignment warnings which can arise. The first is when mass assignment actually occurs, such as the example above. This results in a warning like

Unprotected mass assignment near line 61: User.new(params[:user])

The other warning is raised whenever a model is found which does not use attr_accessible. This produces generic warnings like

Mass assignment is not restricted using attr_accessible

with a list of affected models.

In Rails 3.1 and newer, mass assignment can easily be disabled:

config.active_record.whitelist_attributes = true

Unfortunately, it can also easily be bypassed:

User.new(params[:user], :without_protection => true)

Brakeman will warn on uses of without_protection.

Class has too many lines. [204/100]
Open

class UsersController < ApplicationController
  include AuthorizationHelper
  include ConferenceHelper

  autocomplete :user, :name
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length a class exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Assignment Branch Condition size for create is too high. [34.71/15]
Open

  def create
    # if the user name already exists, register the user by email address
    check = User.find_by(name: params[:user][:name])
    if check
      params[:user][:name] = params[:user][:email]
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Assignment Branch Condition size for show_if_authorized is too high. [31.65/15]
Open

  def show_if_authorized
    @user = User.find_by(name: params[:user][:name])
    if @user.nil?
      flash[:note] = params[:user][:name] + ' does not exist.'
      redirect_to action: 'list'
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Assignment Branch Condition size for show is too high. [28.6/15]
Open

  def show
    if params[:id].nil? || ((current_user_is_a? 'Student') && (!current_user_has_id? params[:id]))
      redirect_to(action: AuthHelper.get_home_action(session[:user]), controller: AuthHelper.get_home_controller(session[:user]))
    else
      @user = User.find(params[:id])
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Method has too many lines. [22/10]
Open

  def create
    # if the user name already exists, register the user by email address
    check = User.find_by(name: params[:user][:name])
    if check
      params[:user][:name] = params[:user][:email]
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method has too many lines. [22/10]
Open

  def user_params
    params.require(:user).permit(:name,
                                 :crypted_password,
                                 :role_id,
                                 :password_salt,
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method has too many lines. [16/10]
Open

  def list
    letter = params[:letter]
    search_by = params[:search_by]
    # If search parameters present
    if letter.present? && search_by.present?
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method has too many lines. [15/10]
Open

  def show_if_authorized
    @user = User.find_by(name: params[:user][:name])
    if @user.nil?
      flash[:note] = params[:user][:name] + ' does not exist.'
      redirect_to action: 'list'
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Assignment Branch Condition size for keys is too high. [19.34/15]
Open

  def keys
    if params[:id].nil? || ((current_user_is_a? 'Student') && (!current_user_has_id? params[:id]))
      redirect_to(action: AuthHelper.get_home_action(session[:user]), controller: AuthHelper.get_home_controller(session[:user]))
    else
      @user = User.find(params[:id])
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Assignment Branch Condition size for update is too high. [18.36/15]
Open

  def update
    # TODO: Remove this permit! and replace it with appropriate strong params after testing.
    # method :- user_params
    params.permit!
    @user = User.find params[:id]
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Assignment Branch Condition size for list is too high. [17.29/15]
Open

  def list
    letter = params[:letter]
    search_by = params[:search_by]
    # If search parameters present
    if letter.present? && search_by.present?
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Method has too many lines. [12/10]
Open

  def action_allowed?
    case params[:action]
    when 'list_pending_requested'
      current_user_has_admin_privileges?
    when 'new'
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Assignment Branch Condition size for destroy is too high. [17.29/15]
Open

  def destroy
    begin
      @user = User.find(params[:id])
      AssignmentParticipant.where(user_id: @user.id).each(&:delete)
      TeamsUser.where(user_id: @user.id).each(&:delete)
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Method has too many lines. [11/10]
Open

  def destroy
    begin
      @user = User.find(params[:id])
      AssignmentParticipant.where(user_id: @user.id).each(&:delete)
      TeamsUser.where(user_id: @user.id).each(&:delete)
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Assignment Branch Condition size for set_anonymized_view is too high. [15.65/15]
Open

  def set_anonymized_view
    anonymized_view_starter_ips = $redis.get('anonymized_view_starter_ips') || ''
    session[:ip] = request.remote_ip
    if anonymized_view_starter_ips.include? session[:ip]
      anonymized_view_starter_ips.delete!(" #{session[:ip]}")
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks that the ABC size of methods is not higher than the configured maximum. The ABC size is based on assignments, branches (method calls), and conditions. See http://c2.com/cgi/wiki?AbcMetric

Method show_if_authorized has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
Open

  def show_if_authorized
    @user = User.find_by(name: params[:user][:name])
    if @user.nil?
      flash[:note] = params[:user][:name] + ' does not exist.'
      redirect_to action: 'list'
Severity: Minor
Found in app/controllers/users_controller.rb - About 25 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Method create has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
Open

  def create
    # if the user name already exists, register the user by email address
    check = User.find_by(name: params[:user][:name])
    if check
      params[:user][:name] = params[:user][:email]
Severity: Minor
Found in app/controllers/users_controller.rb - About 25 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Use each_value instead of each.
Open

      @user.errors.each { |_field, error| error_message << error }
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks for uses of each_key and each_value Hash methods.

Note: If you have an array of two-element arrays, you can put parentheses around the block arguments to indicate that you're not working with a hash, and suppress RuboCop offenses.

Example:

# bad
hash.keys.each { |k| p k }
hash.values.each { |v| p v }
hash.each { |k, _v| p k }
hash.each { |_k, v| p v }

# good
hash.each_key { |k| p k }
hash.each_value { |v| p v }

TODO found
Open

    # TODO: Remove this permit! and replace it with appropriate strong params after testing.
Severity: Minor
Found in app/controllers/users_controller.rb by fixme

Move redirect_to action: 'list' out of the conditional.
Open

      redirect_to action: 'list'
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks for identical lines at the beginning or end of each branch of a conditional statement.

Example:

# bad
if condition
  do_x
  do_z
else
  do_y
  do_z
end

# good
if condition
  do_x
else
  do_y
end
do_z

# bad
if condition
  do_z
  do_x
else
  do_z
  do_y
end

# good
do_z
if condition
  do_x
else
  do_y
end

# bad
case foo
when 1
  do_x
when 2
  do_x
else
  do_x
end

# good
case foo
when 1
  do_x
  do_y
when 2
  # nothing
else
  do_x
  do_z
end

Do not introduce global variables.
Open

    $redis.set('anonymized_view_starter_ips', anonymized_view_starter_ips)
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cops looks for uses of global variables. It does not report offenses for built-in global variables. Built-in global variables are allowed by default. Additionally users can allow additional variables via the AllowedVariables option.

Note that backreferences like $1, $2, etc are not global variables.

Example:

# bad
$foo = 2
bar = $foo + 5

# good
FOO = 2
foo = 2
$stdin.read

Missing top-level class documentation comment.
Open

class UsersController < ApplicationController
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks for missing top-level documentation of classes and modules. Classes with no body are exempt from the check and so are namespace modules - modules that have nothing in their bodies except classes, other modules, or constant definitions.

The documentation requirement is annulled if the class or module has a "#:nodoc:" comment next to it. Likewise, "#:nodoc: all" does the same for all its children.

Example:

# bad
class Person
  # ...
end

# good
# Description/Explanation of Person class
class Person
  # ...
end

Do not introduce global variables.
Open

    anonymized_view_starter_ips = $redis.get('anonymized_view_starter_ips') || ''
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cops looks for uses of global variables. It does not report offenses for built-in global variables. Built-in global variables are allowed by default. Additionally users can allow additional variables via the AllowedVariables option.

Note that backreferences like $1, $2, etc are not global variables.

Example:

# bad
$foo = 2
bar = $foo + 5

# good
FOO = 2
foo = 2
$stdin.read

Use the return of the conditional for variable assignment and comparison.
Open

      case search_by.to_i
      when 1 # Search by username
        @paginated_users = paginate_list.where('name LIKE ?', "%#{letter}%")
      when 2 # Search by fullname
        @paginated_users = paginate_list.where('fullname LIKE ?', "%#{letter}%")
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

Move redirect_to action: 'list' out of the conditional.
Open

      redirect_to action: 'list'
Severity: Minor
Found in app/controllers/users_controller.rb by rubocop

This cop checks for identical lines at the beginning or end of each branch of a conditional statement.

Example:

# bad
if condition
  do_x
  do_z
else
  do_y
  do_z
end

# good
if condition
  do_x
else
  do_y
end
do_z

# bad
if condition
  do_z
  do_x
else
  do_z
  do_y
end

# good
do_z
if condition
  do_x
else
  do_y
end

# bad
case foo
when 1
  do_x
when 2
  do_x
else
  do_x
end

# good
case foo
when 1
  do_x
  do_y
when 2
  # nothing
else
  do_x
  do_z
end

There are no issues that match your filters.

Category
Status