diff --git a/app/controllers/administrateurs/exports_controller.rb b/app/controllers/administrateurs/exports_controller.rb
index aaa8750be..44d953356 100644
--- a/app/controllers/administrateurs/exports_controller.rb
+++ b/app/controllers/administrateurs/exports_controller.rb
@@ -4,19 +4,14 @@ module Administrateurs
before_action :ensure_not_super_admin!
def download
- export = Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options)
-
- if export.available? && export.old? && force_export?
- export.destroy
- export = Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options)
- end
+ export = Export.find_or_create_export(export_format, all_groupe_instructeurs, force: force_export?, **export_options)
+ @dossiers_count = export.count
+ assign_exports
if export.available?
respond_to do |format|
format.turbo_stream do
- @dossiers_count = export.count
- assign_exports
- flash.notice = "L’export au format \"#{export_format}\" est prêt. Vous pouvez le télécharger"
+ flash.notice = export.flash_message
end
format.html do
@@ -25,18 +20,13 @@ module Administrateurs
end
else
respond_to do |format|
- notice_message = "Nous générons cet export. Veuillez revenir dans quelques minutes pour le télécharger."
-
format.turbo_stream do
- @dossiers_count = export.count
- assign_exports
if !params[:no_progress_notification]
- flash.notice = notice_message
+ flash.notice = export.flash_message
end
end
-
format.html do
- redirect_to admin_procedure_archives_url(@procedure), notice: notice_message
+ redirect_to admin_procedure_archives_url(@procedure), notice: export.flash_message
end
end
end
diff --git a/app/controllers/instructeurs/procedures_controller.rb b/app/controllers/instructeurs/procedures_controller.rb
index 5c62c988b..e6cf1eddc 100644
--- a/app/controllers/instructeurs/procedures_controller.rb
+++ b/app/controllers/instructeurs/procedures_controller.rb
@@ -158,21 +158,17 @@ module Instructeurs
.visible_by_administration
.exists?(groupe_instructeur_id: groupe_instructeur_ids) && !instructeur_as_manager?
- export = Export.find_or_create_export(export_format, groupe_instructeurs, **export_options)
+ export = Export.find_or_create_export(export_format, groupe_instructeurs, force: force_export?, **export_options)
- if export.available? && export.old? && force_export?
- export.destroy
- export = Export.find_or_create_export(export_format, groupe_instructeurs, **export_options)
- end
+ @procedure = procedure
+ @statut = export_options[:statut]
+ @dossiers_count = export.count
+ assign_exports
if export.available?
respond_to do |format|
format.turbo_stream do
- @procedure = procedure
- @statut = export_options[:statut]
- @dossiers_count = export.count
- assign_exports
- flash.notice = "L’export au format \"#{export_format}\" est prêt. Vous pouvez le télécharger"
+ flash.notice = export.flash_message
end
format.html do
@@ -181,20 +177,13 @@ module Instructeurs
end
else
respond_to do |format|
- notice_message = "Nous générons cet export. Veuillez revenir dans quelques minutes pour le télécharger."
-
format.turbo_stream do
- @procedure = procedure
- @statut = export_options[:statut]
- @dossiers_count = export.count
- assign_exports
if !params[:no_progress_notification]
- flash.notice = notice_message
+ flash.notice = export.flash_message
end
end
-
format.html do
- redirect_to instructeur_procedure_url(procedure), notice: notice_message
+ redirect_to instructeur_procedure_url(procedure), notice: export.flash_message
end
end
end
diff --git a/app/models/export.rb b/app/models/export.rb
index ec13aec82..80fccbe1b 100644
--- a/app/models/export.rb
+++ b/app/models/export.rb
@@ -83,13 +83,23 @@ class Export < ApplicationRecord
procedure_presentation_id.present?
end
- def self.find_or_create_export(format, groupe_instructeurs, time_span_type: time_span_types.fetch(:everything), statut: statuts.fetch(:tous), procedure_presentation: nil)
- create_with(groupe_instructeurs: groupe_instructeurs, procedure_presentation: procedure_presentation, procedure_presentation_snapshot: procedure_presentation&.snapshot)
- .includes(:procedure_presentation)
- .create_or_find_by(format: format,
- time_span_type: time_span_type,
- statut: statut,
- key: generate_cache_key(groupe_instructeurs.map(&:id), procedure_presentation))
+ def flash_message
+ if available?
+ "L’export au format \"#{format}\" est prêt. Vous pouvez le télécharger"
+ else
+ "Nous générons cet export. Veuillez revenir dans quelques minutes pour le télécharger."
+ end
+ end
+
+ def self.find_or_create_export(format, groupe_instructeurs, time_span_type: time_span_types.fetch(:everything), statut: statuts.fetch(:tous), procedure_presentation: nil, force: false)
+ export = create_or_find_export(format, groupe_instructeurs, time_span_type: time_span_type, statut: statut, procedure_presentation: procedure_presentation)
+
+ if export.available? && export.old? && force
+ export.destroy
+ create_or_find_export(format, groupe_instructeurs, time_span_type: time_span_type, statut: statut, procedure_presentation: procedure_presentation)
+ else
+ export
+ end
end
def self.find_for_groupe_instructeurs(groupe_instructeurs_ids, procedure_presentation)
@@ -121,6 +131,15 @@ class Export < ApplicationRecord
}
end
+ def self.create_or_find_export(format, groupe_instructeurs, time_span_type:, statut:, procedure_presentation:)
+ create_with(groupe_instructeurs: groupe_instructeurs, procedure_presentation: procedure_presentation, procedure_presentation_snapshot: procedure_presentation&.snapshot)
+ .includes(:procedure_presentation)
+ .create_or_find_by(format: format,
+ time_span_type: time_span_type,
+ statut: statut,
+ key: generate_cache_key(groupe_instructeurs.map(&:id), procedure_presentation))
+ end
+
def self.generate_cache_key(groupe_instructeurs_ids, procedure_presentation = nil)
if procedure_presentation.present?
[
diff --git a/config/brakeman.ignore b/config/brakeman.ignore
index f673cbec3..52d48e3db 100644
--- a/config/brakeman.ignore
+++ b/config/brakeman.ignore
@@ -1,25 +1,5 @@
{
"ignored_warnings": [
- {
- "warning_type": "Redirect",
- "warning_code": 18,
- "fingerprint": "170b506bd3d25eb50f464703f9d993bf2e124d5cbc8478ce9d9d06a15b4bc55e",
- "check_name": "Redirect",
- "message": "Possible unprotected redirect",
- "file": "app/controllers/instructeurs/exports_controller.rb",
- "line": 26,
- "link": "https://brakemanscanner.org/docs/warning_types/redirect/",
- "code": "redirect_to(Export.find_or_create_export(export_format, groupe_instructeurs, **export_options).file.service_url)",
- "render_path": null,
- "location": {
- "type": "method",
- "class": "Instructeurs::ExportsController",
- "method": "download"
- },
- "user_input": "Export.find_or_create_export(export_format, groupe_instructeurs, **export_options).file.service_url",
- "confidence": "High",
- "note": ""
- },
{
"warning_type": "Cross-Site Scripting",
"warning_code": 2,
@@ -35,7 +15,7 @@
"type": "controller",
"class": "Users::DossiersController",
"method": "merci",
- "line": 204,
+ "line": 232,
"file": "app/controllers/users/dossiers_controller.rb",
"rendered": {
"name": "users/dossiers/merci",
@@ -92,63 +72,23 @@
"confidence": "Weak",
"note": "explicitely sanitized even if we are using html_safe"
},
- {
- "warning_type": "SQL Injection",
- "warning_code": 0,
- "fingerprint": "4254ed68100af9b496883716b1fd658e1943b2385a0d08de5a6ef5c600c1a8f9",
- "check_name": "SQL",
- "message": "Possible SQL injection",
- "file": "app/models/traitement.rb",
- "line": 52,
- "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
- "code": "ActiveRecord::Base.connection.execute(\"select date_trunc('month', r1.processed_at::TIMESTAMPTZ AT TIME ZONE '#{Time.zone.formatted_offset}'::INTERVAL) as month, count(r1.processed_at)\\nfrom (#{Traitement.select(\"max(traitements.processed_at) as processed_at\").termine.where(:dossier => Dossier.state_termine.where(:groupe_instructeur => groupe_instructeurs)).group(:dossier_id).to_sql}) as r1\\ngroup by date_trunc('month', r1.processed_at::TIMESTAMPTZ AT TIME ZONE '#{Time.zone.formatted_offset}'::INTERVAL)\\norder by month desc\\n\")",
- "render_path": null,
- "location": {
- "type": "method",
- "class": "Traitement",
- "method": "Traitement.count_dossiers_termines_by_month"
- },
- "user_input": "Time.zone.formatted_offset",
- "confidence": "Medium",
- "note": ""
- },
{
"warning_type": "Redirect",
"warning_code": 18,
- "fingerprint": "589e457617e6ad3d35f454b4af8ed326817930d6a724febcf680d7e03c6aeaa2",
+ "fingerprint": "8a1ccc92988486094b2c89e586902a3b6fcbd43910d6363dce14b9981ca8ddeb",
"check_name": "Redirect",
"message": "Possible unprotected redirect",
- "file": "app/controllers/targeted_user_links_controller.rb",
- "line": 7,
+ "file": "app/controllers/instructeurs/procedures_controller.rb",
+ "line": 175,
"link": "https://brakemanscanner.org/docs/warning_types/redirect/",
- "code": "redirect_to(TargetedUserLink.find(params[:id]).redirect_url(Rails.application.routes.url_helpers))",
+ "code": "redirect_to(Export.find_or_create_export(export_format, current_instructeur.groupe_instructeurs.where(:procedure => procedure), :force => force_export?, **export_options).file.service_url)",
"render_path": null,
"location": {
"type": "method",
- "class": "TargetedUserLinksController",
- "method": "show"
+ "class": "Instructeurs::ProceduresController",
+ "method": "download_export"
},
- "user_input": "TargetedUserLink.find(params[:id]).redirect_url(Rails.application.routes.url_helpers)",
- "confidence": "High",
- "note": ""
- },
- {
- "warning_type": "Redirect",
- "warning_code": 18,
- "fingerprint": "8f8133f0679f6301e098c4b9c61c2217224126856963abd02cdc5e54efb4e818",
- "check_name": "Redirect",
- "message": "Possible unprotected redirect",
- "file": "app/controllers/administrateurs/exports_controller.rb",
- "line": 22,
- "link": "https://brakemanscanner.org/docs/warning_types/redirect/",
- "code": "redirect_to(Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options).file.service_url)",
- "render_path": null,
- "location": {
- "type": "method",
- "class": "Administrateurs::ExportsController",
- "method": "download"
- },
- "user_input": "Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options).file.service_url",
+ "user_input": "Export.find_or_create_export(export_format, current_instructeur.groupe_instructeurs.where(:procedure => procedure), :force => force_export?, **export_options).file.service_url",
"confidence": "High",
"note": ""
},
@@ -159,7 +99,7 @@
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/concerns/dossier_filtering_concern.rb",
- "line": 25,
+ "line": 30,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "where(\"#{values.count} OR #{\"(#{ProcedurePresentation.sanitized_column(table, column)} ILIKE ?)\"}\", *values.map do\n \"%#{value}%\"\n end)",
"render_path": null,
@@ -175,24 +115,24 @@
{
"warning_type": "Redirect",
"warning_code": 18,
- "fingerprint": "eae88be293b3849e07be81a18de99c04b08c7b2c045cc4a43ca3624ea178d965",
+ "fingerprint": "e2220b7cda7df5d02de77e7c3ce137653126e0d8e91ce445676b63ec4c94bbcb",
"check_name": "Redirect",
"message": "Possible unprotected redirect",
- "file": "app/controllers/instructeurs/procedures_controller.rb",
- "line": 168,
+ "file": "app/controllers/administrateurs/exports_controller.rb",
+ "line": 18,
"link": "https://brakemanscanner.org/docs/warning_types/redirect/",
- "code": "redirect_to(Export.find_or_create_export(export_format, current_instructeur.groupe_instructeurs.where(:procedure => procedure), **export_options).file.service_url)",
+ "code": "redirect_to(Export.find_or_create_export(export_format, all_groupe_instructeurs, :force => force_export?, **export_options).file.service_url)",
"render_path": null,
"location": {
"type": "method",
- "class": "Instructeurs::ProceduresController",
- "method": "download_export"
+ "class": "Administrateurs::ExportsController",
+ "method": "download"
},
- "user_input": "Export.find_or_create_export(export_format, current_instructeur.groupe_instructeurs.where(:procedure => procedure), **export_options).file.service_url",
+ "user_input": "Export.find_or_create_export(export_format, all_groupe_instructeurs, :force => force_export?, **export_options).file.service_url",
"confidence": "High",
"note": ""
}
],
- "updated": "2022-07-08 13:14:19 +0200",
+ "updated": "2022-11-15 23:04:53 +0100",
"brakeman_version": "5.2.2"
}