URL Perms: Reports, widgets controllers

Replace request IDs in URLs with titles
mysociety · Dec 7, 2023 · f082e20 · f082e20
1 parent df57904
commit f082e20
Show file tree

Hide file tree

Showing 11 changed files with 100 additions and 83 deletions.
diff --git a/app/controllers/reports_controller.rb b/app/controllers/reports_controller.rb
@@ -51,7 +51,7 @@ def new
   def set_info_request
     @info_request = InfoRequest
                       .not_embargoed
-                        .find_by_url_title!(params[:request_id])
+                        .find_by_url_title!(params[:request_url_title])
   end
 
   def set_comment

diff --git a/app/controllers/widget_votes_controller.rb b/app/controllers/widget_votes_controller.rb
@@ -37,7 +37,8 @@ def check_widget_config
   end
 
   def find_info_request
-    @info_request = InfoRequest.not_embargoed.find(params[:request_id])
+    @info_request = InfoRequest.not_embargoed.
+      find_by!(url_title: params[:request_url_title])
   end
 
   def check_prominence

diff --git a/app/controllers/widgets_controller.rb b/app/controllers/widgets_controller.rb
@@ -42,7 +42,7 @@ def check_widget_config
   end
 
   def find_info_request
-    @info_request = InfoRequest.find(params[:request_id])
+    @info_request = InfoRequest.find_by!(url_title: params[:request_url_title])
   end
 
   def check_prominence

diff --git a/app/views/request/_act.html.erb b/app/views/request/_act.html.erb
@@ -44,7 +44,7 @@
 <% if AlaveteliConfiguration::enable_widgets %>
   <div class="act_link">
     <i class="act-link-icon act-link-icon--widget"></i>
-    <%= link_to _("Create a widget for this request"), new_request_widget_path(info_request) %>
+    <%= link_to _("Create a widget for this request"), new_request_widget_path(info_request.url_title) %>
   </div>
 <% end %>
 

diff --git a/app/views/widgets/new.html.erb b/app/views/widgets/new.html.erb
@@ -4,12 +4,12 @@
   <%= _("To add a widget for <b>{{info_request_title}}</b>, copy and paste " \
         "the following code to your web page:",
         :info_request_title => @info_request.title) %>
-  <textarea autofocus readonly rows='4' cols='60' id='widgetbox'><iframe src='<%= request_widget_url(@info_request) %>' width='320' height='215' frameborder='0' marginwidth='0' marginheight='0'></iframe></textarea>
+  <textarea autofocus readonly rows='4' cols='60' id='widgetbox'><iframe src='<%= request_widget_url(@info_request.url_title) %>' width='320' height='215' frameborder='0' marginwidth='0' marginheight='0'></iframe></textarea>
 
 </p>
 
 <p>
   <%= _("The widget will look like this:") %>
   <br>
-  <iframe src='<%= request_widget_url(@info_request) %>' width='320' height='215' frameborder='0' marginwidth='0' marginheight='0'></iframe>
+  <iframe src='<%= request_widget_url(@info_request.url_title) %>' width='320' height='215' frameborder='0' marginwidth='0' marginheight='0'></iframe>
 </p>
diff --git a/app/views/widgets/show.html.erb b/app/views/widgets/show.html.erb
@@ -57,7 +57,7 @@
           <%= _('I also want to know!') %>
         <% end %>
       <% else %>
-        <%= form_tag request_widget_votes_url(@info_request),
+        <%= form_tag request_widget_votes_url(request_url_title: @info_request.url_title),
               :method => 'post', :target => '_top' do %>
           <%= submit_tag _('I also want to know!'),
                 :class => 'alaveteli-widget__bottom__action alaveteli-widget__button--create-vote',

diff --git a/config/routes.rb b/config/routes.rb
@@ -233,7 +233,7 @@ def matches?(request)
   end
   get '/health_checks' => redirect('/health/checks')
 
-  resources :request, :only => [] do
+  resources :request, :only => [], param: :url_title do
     resource :report, :only => [:new, :create]
     resource :widget, :only => [:new, :show]
     resources :widget_votes, :only => [:create]

diff --git a/config/routes/redirects.rb b/config/routes/redirects.rb
@@ -42,3 +42,19 @@ def redirect_to_info_request_url_title_path(request:, locale:, id:, suffix: nil)
       redirect_to_info_request_url_title_path(request: request, **params)
     end
   )
+
+get '/request/:id(/*suffix)',
+  constraints: { id: /\d+/, suffix: %r(report/new) },
+  to: redirect(
+    lambda do |params, request|
+      redirect_to_info_request_url_title_path(request: request, **params)
+    end
+  )
+
+get '/request/:id(/*suffix)',
+  constraints: { id: /\d+/, suffix: %r(widget(/new)?) },
+  to: redirect(
+    lambda do |params, request|
+      redirect_to_info_request_url_title_path(request: request, **params)
+    end
+  )