ba0fcc93-beed-4721-a191-73ccb4799108

1	# frozen_string_literal: true
2	class ReportsController < ApplicationController	1✔
3	def dataset_list	1✔
4	if current_user.super_admin? \|\| current_user.moderator?	5✔
5	@works = Work.where(sql_where(params))	4✔
6	if params["format"] == "csv"	4✔
NEW 7	send_data generate_csv(@works), type: "text/plain", filename: "datasets.csv", disposition: "attachment"	×
8	end
9	else
10	redirect_to "/"	1✔
11	end
12	end
13
14	private	1✔
15
16	def generate_csv(works)	1✔
NEW 17	text = "TITLE, STATUS, GROUP, YEAR, TOTAL_FILE_SIZE\r\n"	×
NEW 18	works.each do \|work\|	×
NEW 19	text += "#{work.title}, #{work.state}, #{work.group.code}, #{work['metadata']['publication_year']}, #{work.total_file_size}\r\n"	×
20	end
NEW 21	text	×
22	end
23
24	def sql_where(params)	1✔
25	sql_where = []	4✔
26	if params["status"] == "finished"	4✔
NEW 27	sql_where << "state = 'approved'"	×
28	elsif params["status"] == "unfinished"	4✔
NEW 29	sql_where << "state != 'approved'"	×
30	end
31
32	if params["group"].present? && params["group"] != "ALL"	4✔
33	group_id = Group.where(code: params["group"]).first.id	1✔
34	sql_where << "group_id = #{group_id}"	1✔
35	end
36
37	if params["year"].present? && params["year"] != "ALL"	4✔
NEW 38	year = params["year"].to_i # Force to int to guard against SQL injection	×
NEW 39	sql_where << "metadata->>'publication_year' = '#{year}'"	×
40	end
41	sql_where.join(" AND ")	4✔
42	end
43	end

Source File Press 'n' to go to next uncovered line, 'b' for previous