<commit_before>class AttendeesController < ApplicationController

  # Access Control
  before_filter :allow_only_admin, :except => [:create, :destroy, :edit, :index, :new, :update, :vip]
  before_filter :allow_only_self_or_admin, :only => [:destroy, :edit, :update]
  
  def index
    # by default, sort by rank (0 is non-player)
    order_by_clause = "rank = 0, rank desc"

    # if a sort order was specified, make sure it is not a SQL injection attack
    valid_sortable_columns = %w[given_name family_name rank created_at country]
    if (valid_sortable_columns.include?(params[:sort])) then
      order_by_clause = params[:sort]
    end

    # some sort orders could reveal clues about anonymous people,
    # so we must first order by anonymity to protect against that -Jared
    unsafe_for_anon = %w[given_name family_name]
    if (unsafe_for_anon.include?(order_by_clause)) then
      order_by_clause = 'anonymous, ' + order_by_clause
    end

    # get all attendees
    @attendees = Attendee.order(order_by_clause)

    # We are also going to show the list of pre-registrants, at least for now.
    # Obviously, at some point they will all hopefully sign up for real user accounts
    # and then this list will be defunct. -Jared 1/23/11
    @preregistrants = Preregistrant.order('preregdate asc')

    # get some fun statistics
    @dan_count = Attendee.where("rank IN (?)", (1)..(9)).count
    @kyu_count = Attendee.where("rank IN (?)", (-30)..(-1)).count
    @np_count = Attendee.where(:rank => 0).count
    @youngest_attendee = Attendee.reasonable_birth_date.order('birth_date desc').first
    @oldest_attendee = Attendee.reasonable_birth_date.order('birth_date desc').last
    @male_count = Attendee.where(:gender => 'm').count
    @female_count = Attendee.where(:gender => 'f').count
  end

  # GET /attendees/new
  def new

    # visitors can not get the new attendee form
    unless current_user.present? then
      render_access_denied
      return
    end

    # copy over certain fields from the primary_attendee -Jared
    @attendee = Attendee.new
    ['phone','address_1','address_2','city','state','zip','country','phone','email'].each { |f|
      @attendee[f] = current_user.primary_attendee[f]
    }
  end
  
  # POST /attendees
  def create

    # visitors can not create attendees
    unless current_user.present? then
      render_access_denied
      return
    end

    # no-one can create an attendee under a different user
    if params[:attendee][:user_id].present? and params[:attendee][:user_id] != current_user.id then
      render_access_denied
      return
    end

    @attendee = Attendee.new(params[:attendee])
    @attendee.user_id = current_user.id
    if @attendee.save
      # After successful save, redirect to the "Edit Go Info" form
      # We are afraid if we do not, then no one will fill it out -Jared
      redirect_to(edit_attendee_path(@attendee.id) + "/baduk")
    else
      render :action => "new"
    end
  end

  # GET /attendees/1/edit/basics
  # GET /attendees/1/edit/baduk
  # GET /attendees/1/edit/roomboard
  def edit
    @attendee = Attendee.find_by_id(params[:id].to_i)
    
    # there are too many attendee attributes to fit them all on one form page
    # so, I've added a param called page.  Alf, would you have done this differently?
    # Thanks, -Jared 2011.01.08
    @page = get_valid_page_from_params
    
    # Page-specific queries
    init_multipage(@page)
    
    # Render the specific page
    render get_view_name_from_page(@page)
  end

  # PUT /attendees/1
  def update
    @page = get_valid_page_from_params
    @attendee = Attendee.find(params[:id])
    
    # certain fields may only be set by admins
    if (@page == 'admin' && current_user.is_admin?)
      if (params[:attendee][:"deposit_received_at(1i)"].present? &&
          params[:attendee][:"deposit_received_at(2i)"].present? &&
          params[:attendee][:"deposit_received_at(3i)"].present?) \
      then
        @attendee.deposit_received_at = convert_date(params[:attendee], :deposit_received_at)
        params[:attendee].delete :"deposit_received_at(1i)"
        params[:attendee].delete :"deposit_received_at(2i)"
        params[:attendee].delete :"deposit_received_at(3i)"
      else
        @attendee.deposit_received_at = nil
      end
    end

    # handle claimed discounts
    if (@page == 'baduk')
      params[:attendee][:discount_ids] ||= Array.new

      # ignore non-integer discount ids (from unchecked boxes in the view)
      valid_discount_ids = params[:attendee][:discount_ids].delete_if {|d| d.to_i == 0}

      # assign discounts, provided they are non-automatic
      # (only non-automatic discounts may be set by users)
      discounts = Discount.where('is_automatic = ? and id in (?)', false, valid_discount_ids)
      @attendee.discounts << discounts

      # delete param to avoid attr_accessible warning
      params[:attendee].delete :discount_ids
    end

    # update attributes but do not save yet
    @attendee.attributes = params[:attendee]

    # run the appropriate validations for this @page 
    if @attendee.valid_in_form_page?(@page.to_sym)
      @attendee.save(:validate => false)

      # after saving the baduk page, if the attendee has not selected a plan yet,
      # then go to the roomboard page, else return to "my account"<commit_msg>allow users to un-select discounts<commit_after>class AttendeesController < ApplicationController

  # Access Control
  before_filter :allow_only_admin, :except => [:create, :destroy, :edit, :index, :new, :update, :vip]
  before_filter :allow_only_self_or_admin, :only => [:destroy, :edit, :update]
  
  def index
    # by default, sort by rank (0 is non-player)
    order_by_clause = "rank = 0, rank desc"

    # if a sort order was specified, make sure it is not a SQL injection attack
    valid_sortable_columns = %w[given_name family_name rank created_at country]
    if (valid_sortable_columns.include?(params[:sort])) then
      order_by_clause = params[:sort]
    end

    # some sort orders could reveal clues about anonymous people,
    # so we must first order by anonymity to protect against that -Jared
    unsafe_for_anon = %w[given_name family_name]
    if (unsafe_for_anon.include?(order_by_clause)) then
      order_by_clause = 'anonymous, ' + order_by_clause
    end

    # get all attendees
    @attendees = Attendee.order(order_by_clause)

    # We are also going to show the list of pre-registrants, at least for now.
    # Obviously, at some point they will all hopefully sign up for real user accounts
    # and then this list will be defunct. -Jared 1/23/11
    @preregistrants = Preregistrant.order('preregdate asc')

    # get some fun statistics
    @dan_count = Attendee.where("rank IN (?)", (1)..(9)).count
    @kyu_count = Attendee.where("rank IN (?)", (-30)..(-1)).count
    @np_count = Attendee.where(:rank => 0).count
    @youngest_attendee = Attendee.reasonable_birth_date.order('birth_date desc').first
    @oldest_attendee = Attendee.reasonable_birth_date.order('birth_date desc').last
    @male_count = Attendee.where(:gender => 'm').count
    @female_count = Attendee.where(:gender => 'f').count
  end

  # GET /attendees/new
  def new

    # visitors can not get the new attendee form
    unless current_user.present? then
      render_access_denied
      return
    end

    # copy over certain fields from the primary_attendee -Jared
    @attendee = Attendee.new
    ['phone','address_1','address_2','city','state','zip','country','phone','email'].each { |f|
      @attendee[f] = current_user.primary_attendee[f]
    }
  end
  
  # POST /attendees
  def create

    # visitors can not create attendees
    unless current_user.present? then
      render_access_denied
      return
    end

    # no-one can create an attendee under a different user
    if params[:attendee][:user_id].present? and params[:attendee][:user_id] != current_user.id then
      render_access_denied
      return
    end

    @attendee = Attendee.new(params[:attendee])
    @attendee.user_id = current_user.id
    if @attendee.save
      # After successful save, redirect to the "Edit Go Info" form
      # We are afraid if we do not, then no one will fill it out -Jared
      redirect_to(edit_attendee_path(@attendee.id) + "/baduk")
    else
      render :action => "new"
    end
  end

  # GET /attendees/1/edit/basics
  # GET /attendees/1/edit/baduk
  # GET /attendees/1/edit/roomboard
  def edit
    @attendee = Attendee.find_by_id(params[:id].to_i)
    
    # there are too many attendee attributes to fit them all on one form page
    # so, I've added a param called page.  Alf, would you have done this differently?
    # Thanks, -Jared 2011.01.08
    @page = get_valid_page_from_params
    
    # Page-specific queries
    init_multipage(@page)
    
    # Render the specific page
    render get_view_name_from_page(@page)
  end

  # PUT /attendees/1
  def update
    @page = get_valid_page_from_params
    @attendee = Attendee.find(params[:id])
    
    # certain fields may only be set by admins
    if (@page == 'admin' && current_user.is_admin?)
      if (params[:attendee][:"deposit_received_at(1i)"].present? &&
          params[:attendee][:"deposit_received_at(2i)"].present? &&
          params[:attendee][:"deposit_received_at(3i)"].present?) \
      then
        @attendee.deposit_received_at = convert_date(params[:attendee], :deposit_received_at)
        params[:attendee].delete :"deposit_received_at(1i)"
        params[:attendee].delete :"deposit_received_at(2i)"
        params[:attendee].delete :"deposit_received_at(3i)"
      else
        @attendee.deposit_received_at = nil
      end
    end

    # handle claimed discounts
    if (@page == 'baduk')
      params[:attendee][:discount_ids] ||= Array.new

      # ignore non-integer discount ids (from unchecked boxes in the view)
      valid_discount_ids = params[:attendee][:discount_ids].delete_if {|d| d.to_i == 0}

      # assign discounts, provided they are non-automatic
      # (only non-automatic discounts may be set by users)
      discounts = Discount.where('is_automatic = ? and id in (?)', false, valid_discount_ids)
      @attendee.discounts.clear
      @attendee.discounts << discounts

      # delete param to avoid attr_accessible warning
      params[:attendee].delete :discount_ids
    end

    # update attributes but do not save yet
    @attendee.attributes = params[:attendee]

    # run the appropriate validations for this @page 
    if @attendee.valid_in_form_page?(@page.to_sym)
      @attendee.save(:validate => false)

      # after saving the baduk page, if the attendee has not selected a plan yet,
      # then go to the roomboard page, else return to "my account"
{'fraction_non_alphanumeric': 0.10484096632776793, 'fraction_numerical': 0.006342691913067811, 'mean_word_length': 3.3356247472705216, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '511603', 'n_tokens_mistral': 3598, 'n_tokens_neox': 3444, 'n_words': 932}