diff --git a/Gemfile b/Gemfile index e9cf98b0..7823727f 100644 --- a/Gemfile +++ b/Gemfile @@ -25,6 +25,7 @@ gem 'pundit' gem 'redis', '~> 5.0' gem 'sentry-ruby' gem 'sentry-rails' +gem 'stackprof' gem 'sidekiq', '~> 7.3' gem 'sassc-rails' gem 'simple_form', '~> 5.3' diff --git a/Gemfile.lock b/Gemfile.lock index de8fa8eb..bfc51257 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -317,14 +317,15 @@ GEM rspec-mocks (~> 3.12) rspec-support (~> 3.12) racc (1.8.1) - rack (3.1.12) + rack (3.1.14) rack-accept (0.4.5) rack (>= 0.4) rack-protection (4.1.1) base64 (>= 0.1.0) logger (>= 1.6.0) rack (>= 3.0.0, < 4) - rack-session (2.0.0) + rack-session (2.1.1) + base64 (>= 0.1.0) rack (>= 3.0.0) rack-test (2.1.0) rack (>= 1.3) @@ -500,6 +501,7 @@ GEM net-scp (>= 1.1.2) net-sftp (>= 2.1.2) net-ssh (>= 2.8.0) + stackprof (0.2.27) stimulus-rails (1.3.4) railties (>= 6.0.0) stringio (3.1.1) @@ -600,6 +602,7 @@ DEPENDENCIES simple_form (~> 5.3) simplecov skylight + stackprof stimulus-rails turbo-rails turnout2024 diff --git a/app/controllers/entries_controller.rb b/app/controllers/entries_controller.rb index 7135969f..6f18b400 100644 --- a/app/controllers/entries_controller.rb +++ b/app/controllers/entries_controller.rb @@ -139,7 +139,7 @@ def set_entry # For applicant_profile, we want to find the entry first, then authorize it def set_entry_for_profile - @entry = Entry.find(params[:id]) + @entry = policy_scope(Entry).find(params[:id]) end def authorize_entry diff --git a/app/controllers/round_judge_assignments_controller.rb b/app/controllers/round_judge_assignments_controller.rb index c3927068..91c3c845 100644 --- a/app/controllers/round_judge_assignments_controller.rb +++ b/app/controllers/round_judge_assignments_controller.rb @@ -11,7 +11,7 @@ def index def create @round_judge_assignment = @judging_round.round_judge_assignments.build(round_judge_assignment_params) - + if @round_judge_assignment.save redirect_to container_contest_description_contest_instance_judging_round_round_judge_assignments_path( @container, @contest_description, @contest_instance, @judging_round @@ -33,7 +33,7 @@ def destroy private def set_judging_round - @container = Container.find(params[:container_id]) + @container = policy_scope(Container).find(params[:container_id]) @contest_description = @container.contest_descriptions.find(params[:contest_description_id]) @contest_instance = @contest_description.contest_instances.find(params[:contest_instance_id]) @judging_round = @contest_instance.judging_rounds.find(params[:judging_round_id]) diff --git a/app/controllers/user_roles_controller.rb b/app/controllers/user_roles_controller.rb index 16613709..f98b3f8f 100644 --- a/app/controllers/user_roles_controller.rb +++ b/app/controllers/user_roles_controller.rb @@ -54,7 +54,7 @@ def destroy private def set_user_role - @user_role = UserRole.find(params[:id]) + @user_role = policy_scope(UserRole).find(params[:id]) end def user_role_params diff --git a/app/views/applicant_dashboard/_available_contests.html.erb b/app/views/applicant_dashboard/_available_contests.html.erb index c61a665c..634f552a 100644 --- a/app/views/applicant_dashboard/_available_contests.html.erb +++ b/app/views/applicant_dashboard/_available_contests.html.erb @@ -3,7 +3,7 @@ <% if params[:filter] && (params[:filter][:department_id].present? || params[:filter][:container_id].present?) %>

Filtered Contests

- Showing contests for + Showing contests for <% if params[:filter][:department_id].present? %> <% department = Department.find_by(id: params[:filter][:department_id]) %> <% if department %> @@ -44,7 +44,7 @@ <% end %> <% end %> - + <% if @active_contests_by_container.any? %> <% @active_contests_by_container.each do |container, contests| %> <%= render partial: 'applicant_dashboard/contest_table', locals: { container: container, contests: contests } %> @@ -52,4 +52,4 @@ <% else %>

No active contests available for your class level.

<% end %> - \ No newline at end of file + diff --git a/app/views/applicant_dashboard/_contest_table.html.erb b/app/views/applicant_dashboard/_contest_table.html.erb index 1488d63c..2ade7082 100644 --- a/app/views/applicant_dashboard/_contest_table.html.erb +++ b/app/views/applicant_dashboard/_contest_table.html.erb @@ -24,7 +24,7 @@ data: { 'bs-toggle': 'tooltip' }, title: 'Enter contest', aria: { label: 'Enter contest' } do %> - + <% end %> @@ -33,4 +33,4 @@ - \ No newline at end of file + diff --git a/app/views/applicant_dashboard/_inactive_submissions_summary.html.erb b/app/views/applicant_dashboard/_inactive_submissions_summary.html.erb new file mode 100644 index 00000000..8192283b --- /dev/null +++ b/app/views/applicant_dashboard/_inactive_submissions_summary.html.erb @@ -0,0 +1,56 @@ +
+
+
+ +
Past Contest Entries
+
+
+
+ <% if (content = render_editable_content('applicant_dashboard', 'inactivesubmission_summary')) %> +
+ <%= content %> +
+ <% end %> +
+ + + + + + + + + + + + <% @entries.joins(:contest_instance).where(contest_instances: { active: false }).each do |entry| %> + + + + + + + + <% end %> + +
ContestTitleTypeSubmittedEntry
<%= "#{entry.contest_instance.contest_description.name } - #{entry.contest_instance.date_open.year}" %><%= entry.title %><%= entry.category.kind %><%= entry.created_at.strftime("%b %d, %Y") %> + <% if entry.entry_file.attached? %> +
+ <%= link_to rails_blob_path(entry.entry_file, disposition: "inline"), + target: "_blank", rel: "noopener", class: "me-2", + title: "View in new tab", aria: { label: "View file" } do %> + + <% end %> + <%= link_to rails_blob_path(entry.entry_file, disposition: "attachment"), + download: "", class: "me-2", + title: "Download file", aria: { label: "Download file" } do %> + + <% end %> +
+ <% else %> + No file + <% end %> +
+
+
+
diff --git a/app/views/applicant_dashboard/_submissions_summary.html.erb b/app/views/applicant_dashboard/_submissions_summary.html.erb index 96ef7164..f9aaad7e 100644 --- a/app/views/applicant_dashboard/_submissions_summary.html.erb +++ b/app/views/applicant_dashboard/_submissions_summary.html.erb @@ -1,6 +1,6 @@
-

Contests You Have Entered:

+

Active Contests You Have Entered:

<% if (content = render_editable_content('applicant_dashboard', 'submission_summary')) %> <%= content %> <% end %> @@ -18,7 +18,7 @@ - <% @entries.each do |entry| %> + <% @entries.joins(:contest_instance).where(contest_instances: { active: true }).each do |entry| %> <%= "#{entry.contest_instance.contest_description.name } - #{entry.contest_instance.date_open.year}" %> <%= entry.title %> @@ -26,14 +26,18 @@ <%= entry.created_at.strftime("%B %d, %Y") %> <% if entry.entry_file.attached? %> - <%= link_to rails_blob_path(entry.entry_file, disposition: "inline"), target: "_blank", rel: "noopener", class: "me-2", title: "View in new tab" do %> - - - <% end %> - <%= link_to rails_blob_path(entry.entry_file, disposition: "attachment"), download: "", class: "me-2", title: "Download file" do %> - - - <% end %> +
+ <%= link_to rails_blob_path(entry.entry_file, disposition: "inline"), + target: "_blank", rel: "noopener", class: "me-2", + title: "View in new tab", aria: { label: "View file" } do %> + + <% end %> + <%= link_to rails_blob_path(entry.entry_file, disposition: "attachment"), + download: "", class: "me-2", + title: "Download file", aria: { label: "Download file" } do %> + + <% end %> +
<% else %> No file attached <% end %> @@ -61,4 +65,4 @@
-
\ No newline at end of file + diff --git a/app/views/applicant_dashboard/index.html.erb b/app/views/applicant_dashboard/index.html.erb index d3b3bebf..3e237f60 100644 --- a/app/views/applicant_dashboard/index.html.erb +++ b/app/views/applicant_dashboard/index.html.erb @@ -13,14 +13,20 @@ <%= render 'applicant_dashboard/opportunities' %> +
+
+ <%= render 'applicant_dashboard/available_contests' %> +
+
<%= render 'applicant_dashboard/submissions_summary', submissions: @submissions %>
+
-
- <%= render 'applicant_dashboard/available_contests' %> +
+ <%= render 'applicant_dashboard/inactive_submissions_summary', submissions: @submissions %>
diff --git a/app/views/containers/_form.html.erb b/app/views/containers/_form.html.erb index 142b67fc..b9bd7c12 100644 --- a/app/views/containers/_form.html.erb +++ b/app/views/containers/_form.html.erb @@ -1,4 +1,7 @@
+ <% if (content = render_editable_content('container', 'form_instructions')) %> + <%= content %> + <% end %> <%= simple_form_for(@container, html: { id: 'new_container_form' }) do |f| %> <%= f.error_notification %> <%= f.error_notification message: f.object.errors[:base].to_sentence if f.object.errors[:base].present? %> @@ -17,10 +20,11 @@ <%= f.input :visibility_id, collection: Visibility.all, + label: 'Dashboard Visibility', label_method: :kind, value_method: :id, hint: safe_join([ - content_tag(:strong, "Public"), " visibility means that this collection of contests will be visible in the applicant's dashboard. ", + content_tag(:strong, "Public"), " visibility means that this collection of contests will be visible to all user's of LSA Evaluate.", tag(:br), content_tag(:strong, "Private"), " visibility requires you provide a special link to applicants in order for them to apply to this collection of contests, it will NOT be visible in the applicant's dashboard." ]), diff --git a/app/views/shared/_footer.html.erb b/app/views/shared/_footer.html.erb index aab6ed09..64056fcc 100644 --- a/app/views/shared/_footer.html.erb +++ b/app/views/shared/_footer.html.erb @@ -4,13 +4,19 @@

<%= image_tag 'LSA_Technology_logo.svg', alt: 'LSA Technology Logo', class: "img-fluid" %> <% if user_signed_in? && current_user.axis_mundi? %> - <%= link_to editable_contents_path, class: "edit-icon", data: { bs_toggle: "tooltip", bs_placement: "top" }, title: "Edit the text blocks in the application" do %> - - <% end %> - | - <%= link_to users_dashboard_index_path, class: "profile-icon", data: { bs_toggle: "tooltip", bs_placement: "top" }, title: "Users Dashboard" do %> - - <% end %> +

+ <%= link_to editable_contents_path, class: "edit-icon", data: { bs_toggle: "tooltip", bs_placement: "top" }, title: "Edit the text blocks in the application" do %> + + <% end %> + | + <%= link_to users_dashboard_index_path, class: "profile-icon", data: { bs_toggle: "tooltip", bs_placement: "top" }, title: "Users Dashboard" do %> + + <% end %> + | + <%= link_to departments_path, class: "profile-icon", data: { bs_toggle: "tooltip", bs_placement: "top" }, title: "Departments" do %> + + <% end %> +
<% end %>

diff --git a/config/application.rb b/config/application.rb index 5d48da55..c2a90691 100644 --- a/config/application.rb +++ b/config/application.rb @@ -20,6 +20,41 @@ # you've limited to :test, :development, or :production. Bundler.require(*Rails.groups) +# Custom middleware to block PHP-related requests +class Rack::Defense + def initialize(app) + @app = app + end + + def call(env) + request = Rack::Request.new(env) + + # Block requests with PHP-related content + if request.post? && ( + request.path.include?('.php') || + request.query_string.include?('php') || + request.content_type.to_s.include?('php') || + request.body.read.to_s.include?('php') + ) + return [403, { 'Content-Type' => 'text/plain' }, ['Forbidden']] + end + + # Block requests with suspicious headers + if request.env['HTTP_USER_AGENT'].to_s.include?('Custom-AsyncHttpClient') || + request.env['HTTP_X_REQUEST_ID'].to_s.include?('cve_2024_4577') + return [403, { 'Content-Type' => 'text/plain' }, ['Forbidden']] + end + + # Block known malicious IPs + suspicious_ips = ['91.99.22.81'] # Add more IPs as needed + if suspicious_ips.include?(request.ip) + return [403, { 'Content-Type' => 'text/plain' }, ['Forbidden']] + end + + @app.call(env) + end +end + module LsaEvaluate class Application < Rails::Application # rubocop:disable Style/Documentation # Initialize configuration defaults for originally generated Rails version. @@ -43,5 +78,16 @@ class Application < Rails::Application # rubocop:disable Style/Documentation # config.eager_load_paths << Rails.root.join("extras") # Don't generate system test files. config.generators.system_tests = nil + + # Add security middleware + config.middleware.use Rack::Defense + + # Configure rate limiting + config.action_dispatch.rate_limiter = { + limit: 300, + period: 5.minutes, + store: :redis, + key: ->(request) { request.ip } + } end end diff --git a/db/seeds.rb b/db/seeds.rb index 4cd72164..3cbb2c8a 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -63,7 +63,11 @@ { page: "judging_assignments", section: "round_specific_instructions", content: ActionText::RichText.new(body: "Instructions for the round_specific_instructions") }, { page: "judging_rounds", section: "comment_interface_behavior", - content: ActionText::RichText.new(body: "Instructions for the comment_interface_behavior") } + content: ActionText::RichText.new(body: "Instructions for the comment_interface_behavior") }, + { page: "applicant_dashboard", section: "inactivesubmission_summary", + content: ActionText::RichText.new(body: "Instructions for the inactivesubmission_summary") }, + { page: "containers", section: "form_instructions", + content: ActionText::RichText.new(body: "Instructions for the form_instructions") } ]) # Seed data for School diff --git a/package.json b/package.json index a109d128..551427e9 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,7 @@ "@popperjs/core": "^2.11.8", "@rails/actiontext": "^7.0.8-3", "autoprefixer": "^10.4.17", - "bootstrap": "^5.3.2", + "bootstrap": "^5.3.3", "bootstrap-icons": "^1.11.3", "esbuild": "^0.25.0", "mac-ca": "^3.1.0", @@ -16,7 +16,7 @@ "postcss-cli": "^11.0.0", "sass": "^1.70.0", "sortablejs": "^1.15.6", - "trix": "^2.1.12" + "trix": "^2.1.15" }, "scripts": { "build": "esbuild app/javascript/*.* --bundle --sourcemap --format=esm --outdir=app/assets/builds --public-path=/assets", diff --git a/spec/features/editable_content_link_spec.rb b/spec/features/editable_content_link_spec.rb index e2ad4e85..92ec630a 100644 --- a/spec/features/editable_content_link_spec.rb +++ b/spec/features/editable_content_link_spec.rb @@ -2,18 +2,19 @@ require 'rails_helper' -RSpec.describe 'EditableContent' do +RSpec.describe 'EditableContent', type: :system do + before do + driven_by(:selenium_chrome_headless) + end + let!(:instructions) do - create(:editable_content, page: 'home', section: 'instructions', - content: 'A short paragraph explaining LSA Evaluate.') + create(:editable_content, page: 'home', section: 'instructions') end let!(:user) { create(:user) } - let!(:admin) { create(:user) } - let!(:role) { create(:role, kind: 'Axis mundi') } + let!(:admin) { create(:user, :axis_mundi) } context 'when axis_mundi is logged in' do before do - admin.roles << role login_as(admin) visit root_path end @@ -23,7 +24,7 @@ end it 'displays a pencil icon within the edit link' do - expect(page).to have_css('a[href="' + edit_editable_content_path(instructions) + '"] .bi.bi-pencil') + expect(page).to have_css('a.edit-link i.bi.bi-pencil') end end @@ -38,7 +39,7 @@ end it 'does not display a pencil icon within the edit link' do - expect(page).to have_no_css('a[href="' + edit_editable_content_path(instructions) + '"] .bi.bi-pencil') + expect(page).to have_no_css('a.edit-link i.bi.bi-pencil') end end diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb index ffa61979..b8835fd8 100644 --- a/spec/rails_helper.rb +++ b/spec/rails_helper.rb @@ -19,7 +19,7 @@ require 'selenium-webdriver' puts "!*!*!*! Running in environment: #{Rails.env} !*!*!*!" -puts "!*!*!*! Running SHOW_BROWSER: #{ENV['SHOW_BROWSER'].present? ? '✅' : '🙈'} !*!*!*!" +puts "!*!*!*! Running SHOW_BROWSER?: #{ENV['SHOW_BROWSER'].present? ? '✅' : '🙈'} !*!*!*!" Rails.root.glob('spec/support/**/*.rb').sort.each { |f| require f } # Checks for pending migrations and applies them before tests are run. diff --git a/spec/system/profile_access_spec.rb b/spec/system/profile_access_spec.rb index 2f1dabfc..142af47a 100644 --- a/spec/system/profile_access_spec.rb +++ b/spec/system/profile_access_spec.rb @@ -9,12 +9,11 @@ let(:axis_mundi_role) { create(:role, kind: 'Axis mundi') } let(:collection_admin_role) { create(:role, kind: 'Collection Administrator') } let(:regular_user) { create(:user) } - let(:axis_mundi_user) { create(:user) } - let(:collection_admin) { create(:user) } + let(:axis_mundi_user) { create(:user, :axis_mundi) } + let(:collection_admin) { create(:user, :with_collection_admin_role) } let(:entry) { create(:entry, profile: profile, contest_instance: contest_instance) } before do - create(:user_role, user: axis_mundi_user, role: axis_mundi_role) create(:assignment, user: collection_admin, container: container, role: collection_admin_role) entry end diff --git a/yarn.lock b/yarn.lock index 1753922a..77e509d7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1703,10 +1703,10 @@ bootstrap-icons@^1.11.3: resolved "https://registry.yarnpkg.com/bootstrap-icons/-/bootstrap-icons-1.11.3.tgz#03f9cb754ec005c52f9ee616e2e84a82cab3084b" integrity sha512-+3lpHrCw/it2/7lBL15VR0HEumaBss0+f/Lb6ZvHISn1mlK83jjFpooTLsMWbIjJMDjDjOExMsTxnXSIT4k4ww== -bootstrap@^5.3.2: - version "5.3.2" - resolved "https://registry.yarnpkg.com/bootstrap/-/bootstrap-5.3.2.tgz#97226583f27aae93b2b28ab23f4c114757ff16ae" - integrity sha512-D32nmNWiQHo94BKHLmOrdjlL05q1c8oxbtBphQFb9Z5to6eGRDCm0QgeaZ4zFBHzfg2++rqa2JkqCcxDy0sH0g== +bootstrap@^5.3.3: + version "5.3.6" + resolved "https://registry.yarnpkg.com/bootstrap/-/bootstrap-5.3.6.tgz#fbd91ebaff093f5b191a1c01a8c866d24f9fa6e1" + integrity sha512-jX0GAcRzvdwISuvArXn3m7KZscWWFAf1MKBcnzaN02qWMb3jpMoUX4/qgeiGzqyIb4ojulRzs89UCUmGcFSzTA== brace-expansion@^1.1.7: version "1.1.11" @@ -2000,10 +2000,10 @@ domexception@^4.0.0: dependencies: webidl-conversions "^7.0.0" -dompurify@^3.2.3: - version "3.2.4" - resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.2.4.tgz#af5a5a11407524431456cf18836c55d13441cd8e" - integrity sha512-ysFSFEDVduQpyhzAob/kkuJjf5zWkZD8/A9ywSp1byueyuCfHamrCBa14/Oc2iiB0e51B+NpxSl5gmzn+Ms/mg== +dompurify@^3.2.5: + version "3.2.5" + resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.2.5.tgz#11b108656a5fb72b24d916df17a1421663d7129c" + integrity sha512-mLPd29uoRe9HpvwP2TxClGQBzGXeEC/we/q+bFlmPPmj2p2Ugl3r6ATu/UU1v77DXNcehiBg9zsr1dREyA/dJQ== optionalDependencies: "@types/trusted-types" "^2.0.7" @@ -3771,12 +3771,12 @@ tr46@^3.0.0: dependencies: punycode "^2.1.1" -trix@^2.1.12: - version "2.1.12" - resolved "https://registry.yarnpkg.com/trix/-/trix-2.1.12.tgz#102306c3a90afcc5b66815ce8d631ee43048a477" - integrity sha512-0hQvJdy257XuzRdCzSQ/QvcqyTp+8ixMxVLWxSbWvEzD2kgKFlcrMjgWZbtVkJENaod+jm2sBTOWAZVNWK+DMA== +trix@^2.1.15: + version "2.1.15" + resolved "https://registry.yarnpkg.com/trix/-/trix-2.1.15.tgz#fabad796ea779a8ae96522402fbc214cbfc4015f" + integrity sha512-LoaXWczdTUV8+3Box92B9b1iaDVbxD14dYemZRxi3PwY+AuDm97BUJV2aHLBUFPuDABhxp0wzcbf0CxHCVmXiw== dependencies: - dompurify "^3.2.3" + dompurify "^3.2.5" type-detect@4.0.8: version "4.0.8"