Class: SqlReposController

Inherits:
CrmController show all
Includes:
Controllers::Destroyable
Defined in:
app/controllers/sql_repos_controller.rb

Overview

Controller: sql repos.

Constant Summary

Constants included from Controllers::ReferenceFindable

Controllers::ReferenceFindable::ID_EMBEDDED_PATTERNS

Constants included from Controllers::AnalyticsEvents

Controllers::AnalyticsEvents::MAX_QUEUED_EVENTS, Controllers::AnalyticsEvents::SESSION_KEY

Constants included from Controllers::ErrorRendering

Controllers::ErrorRendering::NON_CONTENT_PATH_PREFIXES

Instance Method Summary collapse

Methods included from Controllers::Destroyable

#destroy, #perform_destroy

Methods inherited from CrmController

#access_denied, #context_id, #context_object, #crm_home_path, #current_ability, #default_url_options, #download_temp, #get_tempfile_path_for_download, #init_status_job_collector, #initialize_crm_lazy_chunks, #persist_enqueued_status_jobs, #record_not_found, #redirect_to_job_or_fallback, #render_edit_action, #set_context, #set_download_path, #stash_file_for_temp_download, #sync_admin_presence_cookie, #touch_employee_last_seen

Methods inherited from ApplicationController

#account_impersonated?, #add_to_flash, #after_sign_in_path_for, #bypass_forgery_protection?, #chat_enabled?, #cloudflare_cleared?, #default_catalog, #default_url_options, #enable_turbo_frames, #find_publication, #fix_invalid_accept_header, #init_js_utils, #is_globals_call?, #layout_by_resource, #locale_store, #redirect_to, #require_employee_for_crm, #set_base_host, #set_real_ip, #set_report_errors_for, #should_render_layout?, #skip_layout_for_turbo_frame?, #stamp_impersonation_context, #tab_frame_breakout_request?, #warmlyyours_canada_ip?, #warmlyyours_ip?, #y

Methods included from Controllers::ReturnPathHandling

#check_for_return_path, #redirect_to_return_path_or_default

Methods included from Controllers::AnalyticsEvents

#consume_queued_analytics_events, #registration_lead_type, #track_event

Methods included from Controllers::DeviceDetection

#device_detector, #is_ie?

Methods included from Controllers::SubdomainDetection

#is_crm_request?, #is_www_request?, #json_request?

Methods included from Controllers::TurboSafeRedirect

#redirect_to

Methods included from Controllers::TrackingDetection

#bot_request?, #gdpr_country?, #gdpr_country_data, #prevent_bots, #set_tracking_cookie, #track_visitor?

Methods included from Controllers::AcceleratedFileSending

#send_file_accelerated, #send_upload_accelerated

Methods included from Controllers::ErrorRendering

#excp_string, #mail_to_for_error_reporting, #render_400, #render_404, #render_406, #render_410, #render_500, #render_invalid_authenticity_token, #render_ip_spoof_error, #render_unpermitted_parameters, #safe_referer_or_fallback

Methods included from Controllers::TurnstileVerification

#load_turnstile_script_tag, #turnstile_lazy_widget, #turnstile_script_tag, #turnstile_widget, #validate_turnstile!

Methods included from Controllers::CloudflareCaching

edge_cached, #edge_cached_action?, #reset_cloudflare_cache, #set_cloudflare_cache, #skip_edge_cache!, #skip_session

Methods included from Controllers::Webpackable

#preload_webpack_fonts, #webpack_css_include, #webpack_css_url, #webpack_js_include, #wpd_is_running?

Methods included from Controllers::Localizable

#cloudflare_country_locale, #determine_request_locale, #geocoder_locale, #guest_user_locale_check, #locale_optional_www_auth_path?, #param_locale, #set_locale, #set_request_locale, #skip_localization?, #warmlyyours_ip_locale

Methods included from Controllers::Authenticable

#access_denied, #authenticate_account, #authenticate_account!, #authenticate_account_from_login_token!, #check_is_a_manager, #check_is_a_sales_manager, #check_is_an_admin, #check_is_an_employee, #check_party, #clear_mismatched_guest_user, #create_guest_user, #credentials?, #current_or_guest_user, #current_or_guest_user_id_read_only, #current_user, #devise_mapping, #fully_logged_in?, #generate_bot_id, #guest_user, #identifiable?, #init_current_user, #initialize_guest, #load_context_user, #logging_in, #resource, #resource_name, #restrict_access_for_non_employees, #scrubbed_request_path, #user_object, #warn_on_session_guest_id_leak

Methods included from UrlsHelper

#catalog_breadcrumb_links, #catalog_link, #catalog_link_for_product_line, #catalog_link_for_sku, #cms_link, #delocalized_path, #path_to_sales_product_sku, #path_to_sales_product_sku_for_product_line, #path_to_sales_product_sku_for_product_line_slug, #product_line_from_catalog_link, #protocol_neutral_url, #sanitize_external_url, #valid_external_url?

Instance Method Details

#create ⇒ Object

POST /sql_repos
POST /sql_repos.xml



99
100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'app/controllers/sql_repos_controller.rb', line 99

def create
  @sql_repo = SqlRepo.new(params[:sql_repo])

  respond_to do |format|
    if @sql_repo.save
      format.html { redirect_to(@sql_repo, info: 'Sql repo was successfully created.') }
      format.xml  { render xml: @sql_repo, status: :created, location: @sql_repo }
    else
      format.html { render :new, status: :unprocessable_content }
      format.xml  { render xml: @sql_repo.errors, status: :unprocessable_content }
    end
  end
end

#edit ⇒ Object

GET /sql_repos/1/edit



93
94
95
 
# File 'app/controllers/sql_repos_controller.rb', line 93

def edit
  @sql_repo = SqlRepo.find(params[:id])
end

#index ⇒ void

This method returns an undefined value.

Lists saved SQL repos.



23
24
25
26
27
28
29
30
 
# File 'app/controllers/sql_repos_controller.rb', line 23

def index
  @sql_repos = SqlRepo.all

  respond_to do |format|
    format.html # index.html.erb
    format.xml  { render xml: @sql_repos }
  end
end

#new ⇒ Object

GET /sql_repos/new
GET /sql_repos/new.xml



83
84
85
86
87
88
89
90
 
# File 'app/controllers/sql_repos_controller.rb', line 83

def new
  @sql_repo = SqlRepo.new

  respond_to do |format|
    format.html # new.html.erb
    format.xml  { render xml: @sql_repo }
  end
end

#show ⇒ Object

GET /sql_repos/1
GET /sql_repos/1.xml



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'app/controllers/sql_repos_controller.rb', line 34

def show
  @sql_repo = SqlRepo.find(params[:id])

  if @sql_repo.sql_query.present?
    normalized = @sql_repo.sql_query.gsub(%r{/\*.*?\*/}m, '').gsub(/--[^\n]*/, '').strip
    # `\A\s*WITH` catches CTE-based writes like `WITH x AS (DELETE FROM …) SELECT …`
    # that the bare DML keyword check misses; the SET TRANSACTION READ ONLY below
    # is the real guard, but reject the obvious cases up front for a clearer error.
    if normalized.match?(/\A\s*(WITH|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE|COPY|GRANT|REVOKE)\b/i)
      flash[:alert] = "Only SELECT queries are allowed"
      redirect_to sql_repos_path
      return
    end

    conn = ActiveRecord::Base.lease_connection
    # SET LOCAL has no effect outside a transaction; SET TRANSACTION READ ONLY
    # blocks any DML even via mechanisms the regex above doesn't catch.
    conn.transaction do
      conn.execute("SET TRANSACTION READ ONLY")
      conn.execute("SET LOCAL statement_timeout = '30s'")
      @result_set = conn.execute(@sql_repo.sql_query)
    end
  end
  @column_names = @result_set.try(:first).try(:keys) || []

  respond_to do |format|
    format.html
    format.csv do
      csv_string = CSV.generate do |csv|
        # header row
        header_row = @column_names.map(&:to_s)
        csv << header_row
        # data rows
        @result_set.each do |r|
          row_list = r.map(&:last)
          csv << row_list
        end
      end

      # send it to the browsah
      send_data csv_string,
                type: 'text/csv; charset=iso-8859-1; header=present',
                disposition: "attachment; filename=#{@sql_repo.name}.csv"
    end
  end
end

#update ⇒ Object

PUT /sql_repos/1
PUT /sql_repos/1.xml



115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'app/controllers/sql_repos_controller.rb', line 115

def update
  @sql_repo = SqlRepo.find(params[:id])

  respond_to do |format|
    if @sql_repo.update(params[:sql_repo])
      format.html { redirect_to(@sql_repo, info: 'Sql repo was successfully updated.') }
      format.xml  { head :ok }
    else
      format.html { render :edit, status: :unprocessable_content }
      format.xml  { render xml: @sql_repo.errors, status: :unprocessable_content }
    end
  end
end