app/models/user.rb
# Update an account record given a parameter set and a user to confirm permissions on
Update an account record given a parameter set and a user to confirm permissions on
Update an account record given a parameter set and a user to confirm permissions on
def update_from_params user_params, user
    raise ArgumentError, "Something wrong with the parameters" unless user_params
		raise ArgumentError, "Account record hacking by user #{user.full_name}" if !user.admin? && !(["privilege","status","login_status","coordinator_id","district_id","district_grade","date_active","date_inactive"] & user_params.keys).empty? || !user.staff? && !(["first_name","last_name"] & user_params.keys).empty?
    self.privilege = user_params[:privilege] if user_params[:privilege]
    self.login_status = user_params[:login_status] if user_params[:login_status]
    self.status = user_params[:status] if user_params[:status]
    [:date_active,:date_inactive].each do |a|
      next unless user_params[a] && !user_params[a].strip.blank?
      begin
        self[a] = Date.parse(user_params[a])
      rescue ArgumentError
        self.errors.add a, 'requires a valid date in the format yyyy-mm-dd'
      end
    end
    return false unless self.errors.empty?
    if user_params[:coordinator_id] == "0"
      self.coordinator = nil
    else
      self.coordinator = User.find(user_params[:coordinator_id]) 
    end if user_params[:coordinator_id]
    [:login_status, :status, :date_inactive, :date_active, :coordinator_id, :privilege].each do |a|
      user_params.delete a
    end
		self.attributes = user_params
    save
  end
def update_from_params user_params , user raise ArgumentError , "Something wrong with the parameters" unless user_params raise ArgumentError , "Account record hacking by user #{user.full_name}" if ! user . admin? && ! ( [ "privilege" , "status" , "login_status" , "coordinator_id" , "district_id" , "district_grade" , "date_active" , "date_inactive" ] & user_params . keys ) . empty? || ! user . staff? && ! ( [ "first_name" , "last_name" ] & user_params . keys ) . empty? self . privilege = user_params [ :privilege ] if user_params [ :privilege ] self . login_status = user_params [ :login_status ] if user_params [ :login_status ] self . status = user_params [ :status ] if user_params [ :status ] [ :date_active , :date_inactive ] . each do | a | next unless user_params [ a ] && ! user_params [ a ] . strip . blank? begin self [ a ] = Date . parse ( user_params [ a ] ) rescue ArgumentError self . errors . add a , 'requires a valid date in the format yyyy-mm-dd' end end return false unless self . errors . empty? if user_params [ :coordinator_id ] == "0" self . coordinator = nil else self . coordinator = User . find ( user_params [ :coordinator_id ] ) end if user_params [ :coordinator_id ] [ :login_status , :status , :date_inactive , :date_active , :coordinator_id , :privilege ] . each do | a | user_params . delete a end self . attributes = user_params save end
Update an account record given a parameter set and a user to confirm permissions on
Update an account record given a parameter set and a user to confirm permissions on
# check the set of protected attributes and deny access if any are changing without required permissions # if coordinator ID is there change it # clean out these items we just set manually
user_params
<not_specific>
user
<not_specific>