<commit_before>class PagesController < ApplicationController
  load_and_authorize_resource id_param: 'slug'

  def show
  end

  def edit
  end

  def new
    @page = Page.new
  end

  def index
    @pages = Page.all
  end

  def create
    if params[:commit] == 'Save' 
      check_set_owner
      @page.save
      redirect_to "/#{@page.slug}", notice: 'Page was successfully created.'
    else
      show_preview
      render :new
    end
  end

  def update
    if params[:commit] == 'Save'
      check_set_owner
      @page.update(page_params) 
      redirect_to "/#{@page.slug}", notice: 'Page was successfully updated.'
    else
      show_preview
      render :edit
    end
  end

  private

    def check_set_owner
      params.require(:page)
      if params[:page][:user_email] 
        authorize! :set_owner, @page
        @page.user = User.find_by_email!(params[:page][:user_email])
      elsif @page.user == nil
        authorize! :set_owner, @page
        @page.user = current_user
      end
    end

    def show_preview
      # WARNING XSS VULNERABILITY
      params.require(:page)
      if params[:page][:body]
        @body = params[:page][:body]
      end
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def page_params
      params.require(:page).permit(:slug, :title, :body)
    end
end
<commit_msg>disable xss protection when saving/previewing a page<commit_after>class PagesController < ApplicationController
  load_and_authorize_resource id_param: 'slug'

  def show
  end

  def edit
  end

  def new
    @page = Page.new
  end

  def index
    @pages = Page.all
  end

  def create
    # required for what ckeditor sends
    response.headers["X-XSS-Protection"] = 0
    if params[:commit] == 'Save' 
      check_set_owner
      @page.save
      redirect_to "/#{@page.slug}", notice: 'Page was successfully created.'
    else
      show_preview
      render :new
    end
  end

  def update
    # required for what ckeditor sends
    response.headers["X-XSS-Protection"] = 0
    if params[:commit] == 'Save'
      check_set_owner
      @page.update(page_params) 
      redirect_to "/#{@page.slug}", notice: 'Page was successfully updated.'
    else
      show_preview
      render :edit
    end
  end

  private

    def check_set_owner
      params.require(:page)
      if params[:page][:user_email] 
        authorize! :set_owner, @page
        @page.user = User.find_by_email!(params[:page][:user_email])
      elsif @page.user == nil
        authorize! :set_owner, @page
        @page.user = current_user
      end
    end

    def show_preview
      params.require(:page)
      if params[:page][:body]
        @body = params[:page][:body]
      end
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def page_params
      params.require(:page).permit(:slug, :title, :body)
    end
end

{'fraction_non_alphanumeric': 0.09729359369647139, 'fraction_numerical': 0.0006851661527920521, 'mean_word_length': 2.484486873508353, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5982889', 'n_tokens_mistral': 924, 'n_tokens_neox': 905, 'n_words': 247}