app/controllers/hooks_controller.rb
# this method hides the billing params from URL when you redirected to CAS
# so that people are less tempted to mess around
this method hides the billing params from URL when you redirected to CAS
so that people are less tempted to mess around
this method hides the billing params from URL when you redirected to CAS so that people are less tempted to mess around
def add_job_after
    p = session[:external]
    unless p.blank?
      if current_user.login != p[:netid]
        if (rt_user = User.find_by_login p[:netid])
          flash[:big_notice] = "ALERT: Payform is not billing for #{rt_user.name} \
                               because #{current_user.name} is logged in. \
                               Please log #{current_user.name} out of Payform and try billing again from RT."
        else
          flash[:error] = "Please report to Admin. ERROR: Invalid user"
        end
      elsif p[:total] && p[:comments] && p[:date]
        if (dept = Department.find_by_name "STC")
          @payform_item = PayformItem.new(hours: p[:total].to_f,
                                          description: p[:comments],
                                          category: Category.find_by_name("RT"),
                                          payform: Payform.build(dept, current_user, Time.now),
                                          source_url: p[:url],
                                          date: Date.today)
          if @payform_item.save
            flash[:notice] = "Successfully updated payform."
            if p[:url]
              session[:external] = nil
              redirect_to p[:url] and return
            end
          else
            flash[:error] = "Please report to Admin.  ERROR: Could not save to payform."
          end
        else
          flash[:error] = "Please report to Admin. ERROR: Department not found."
        end
      else
        flash[:error] = "Please report to Admin. ERROR: Invalid Params."
      end
      logger.info("**Billing failed** IP #{p[:ip]} sends this to hooks/add_job: #{p.to_json}")
      session[:external] = nil
    else
      logger.info("**Billing failed** add_job_after called with session[:external] empty.")
    end
    redirect_to(root_path)
  end
def add_job_after p = session [ :external ] unless p . blank? if current_user . login != p [ :netid ] if ( rt_user = User . find_by_login p [ :netid ] ) flash [ :big_notice ] = "ALERT: Payform is not billing for #{rt_user.name} \
                               because #{current_user.name} is logged in. \
                               Please log #{current_user.name} out of Payform and try billing again from RT." else flash [ :error ] = "Please report to Admin. ERROR: Invalid user" end elsif p [ :total ] && p [ :comments ] && p [ :date ] if ( dept = Department . find_by_name "STC" ) @payform_item = PayformItem . new ( hours : p [ :total ] . to_f , description : p [ :comments ] , category : Category . find_by_name ( "RT" ) , payform : Payform . build ( dept , current_user , Time . now ) , source_url : p [ :url ] , date : Date . today ) if @payform_item . save flash [ :notice ] = "Successfully updated payform." if p [ :url ] session [ :external ] = nil redirect_to p [ :url ] and return end else flash [ :error ] = "Please report to Admin.  ERROR: Could not save to payform." end else flash [ :error ] = "Please report to Admin. ERROR: Department not found." end else flash [ :error ] = "Please report to Admin. ERROR: Invalid Params." end logger . info ( "**Billing failed** IP #{p[:ip]} sends this to hooks/add_job: #{p.to_json}" ) session [ :external ] = nil else logger . info ( "**Billing failed** add_job_after called with session[:external] empty." ) end redirect_to ( root_path ) end
this method hides the billing params from URL when you redirected to CAS
so that people are less tempted to mess around
this method hides the billing params from URL when you redirected to CAS so that people are less tempted to mess around
#if currently logged in user of RT and Payform are different #if RT is actually sending a valid netid # if user is matched #only bill to STC # SUCCESS!!! # FAIL # log tampering attemps # clear relevant session detail