File manager exception fix #2229
Conversation
📝 Walkthrough📝 Walkthrough📝 Walkthrough📝 WalkthroughWalkthroughThe changes in the pull request involve modifications to the Changes
Assessment against linked issues
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
KesterTan
requested review from
a team and
jlge
and removed request for
a team
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Outside diff range and nitpick comments (1)
spec/controllers/file_manager_controller_spec.rb (1)
164-164: Redundantsign_incalls within test examplesIn several test examples (lines 164, 221, 278, 284, 351, and 358),
sign_inis called inside the test block even though the user is already signed in within thebefore(:each)block. This is unnecessary and can be removed to clean up the tests.Consider removing the redundant
sign_incalls:- sign_in(instructor)Also applies to: 221-221, 278-278, 284-284, 351-351, 358-358
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
- app/controllers/file_manager_controller.rb (5 hunks)
- spec/controllers/file_manager_controller_spec.rb (2 hunks)
🔇 Additional comments (2)
spec/controllers/file_manager_controller_spec.rb (2)
26-33: Well-defined shared example for unauthorized accessThe
unauthorized_accessshared example is correctly implemented. It enhances test coverage by ensuring unauthorized access scenarios are consistently tested across different contexts.
352-352:⚠️ Potential issueVerify correctness of constructed
pathparametersAt lines 352 and 359, the
pathparameter inget :download_tarincludes"autopopulated/test/#{dir_path}"and"autopopulated/test/#{file_path}". Ensure that these paths are correctly constructed and correspond to the actual file system paths used in the application.Run the following script to check the constructed paths:
Also applies to: 359-359
There was a problem hiding this comment.
When I login as a student user and access the file_manager path, it shows the base screen, but no error flash is displayed.
I think a more ideal behavior would be to redirect back to the Autolab homepage and flash the "You are not authorized to view this page." message there. Also when an unauthorized user views the file manager, they can still press the "create folder" and "upload files" buttons which I know don't work but I think it's unideal, so this can be prevented by redirecting out to a different page.
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Outside diff range and nitpick comments (2)
app/controllers/file_manager_controller.rb (2)
Line range hint
30-48: Improve consistency in authorization handlingThe authorization check has been improved, but there are a few consistency issues:
- Using
root_pathinstead offile_manager_index_pathlike other methods- Missing HTTP status code in the redirect
Apply this change:
else flash[:error] = "You are not authorized to view this path" - redirect_to root_path + redirect_to file_manager_index_path, status: :forbidden end
Line range hint
1-258: Consider implementing a before_action filter for authorizationThe controller has duplicate authorization logic across multiple actions. Consider implementing a before_action filter to centralize the authorization checks and reduce code duplication.
Example implementation:
class FileManagerController < ApplicationController before_action :authorize_path_access!, except: [:index] private def authorize_path_access! path = params[:path].presence || "" absolute_path = check_path_exist(path) unless check_instructor(absolute_path) flash[:error] = "You are not authorized to access this path" redirect_to file_manager_index_path, status: :forbidden and return end end end
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
- app/controllers/file_manager_controller.rb (7 hunks)
- spec/controllers/file_manager_controller_spec.rb (3 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- spec/controllers/file_manager_controller_spec.rb
Description
This PR fixes the routing when a user is not allowed to access a path. This also adds unit tests which tests this functionality for this fix.
Resolves #2228
How Has This Been Tested?
rake spec SPEC=./spec/controllers/file_manager_controller_spec.rband make sure that everything passesTypes of changes
Checklist:
overcommit --install && overcommit --signto use pre-commit hook for linting