25188412317

Committed 30 Apr 2026 08:44PM UTC coverage: 71.053% (+1.2%) from 69.82%

Build # 25188412317

Build Type

Pull #421

circleci

Committed by

Janell-Huyck

Commit Message

Harden edit-user return path handling to satisfy Brakeman XSS checks.

Move return_to sanitization into UsersController via url_from and consume only trusted paths in the edit view and related spec.

Made-with: Cursor

Pull Request Pull Request #421: WIP Libappo1 23 implement sso

Coverage Stats

80 of 91 new or added lines in 7 files covered. (87.91%)

3 existing lines in 2 files now uncovered.

810 of 1140 relevant lines covered (71.05%)

22.65 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

85.0

/app/controllers/application_controller.rb

# frozen_string_literal: true

# Application Controller
class ApplicationController < ActionController::Base
  helper_method :navigation
  before_action :configure_permitted_parameters, if: :devise_controller?
  before_action :require_profile_completion
  $deployed_at = Time.zone.now.strftime('%Y-%m-%d %H:%M:%S')
  # Redirect to dashboard on user login
  def after_sign_in_path_for(_resource)
    # return the path based on resource
    dashboard_path
  end

  protected

  def require_profile_completion
    return if skip_profile_completion_check?

    redirect_to user_edit_path(current_user.id, return_to: dashboard_path),
                alert: 'Please confirm your profile details before continuing.'
  end

  def skip_profile_completion_check?
    !user_signed_in? ||
      !Rails.configuration.x.auth.shibboleth_enabled ||
      current_user.role.to_s == 'root_admin' ||
      profile_complete? ||
      on_allowed_profile_page? ||
      devise_controller?
  end

  def profile_complete?
    current_user.department.present? && current_user.title.present?
  end

  def on_allowed_profile_page?
    controller_name == 'users' && %w[edit update].include?(action_name)
  end

  def configure_permitted_parameters
    devise_parameter_sanitizer.permit(:sign_up,
                                      keys: %i[first_name last_name department title email roles active])
    devise_parameter_sanitizer.permit(:account_update,
                                      keys: %i[first_name last_name department title email])
  end
end

1	# frozen_string_literal: true
2
3	# Application Controller
4	class ApplicationController < ActionController::Base	2✔
5	helper_method :navigation	2✔
6	before_action :configure_permitted_parameters, if: :devise_controller?	2✔
7	before_action :require_profile_completion	2✔
8	$deployed_at = Time.zone.now.strftime('%Y-%m-%d %H:%M:%S')	2✔
9	# Redirect to dashboard on user login
10	def after_sign_in_path_for(_resource)	2✔
11	# return the path based on resource
12	dashboard_path	156✔
13	end
14
15	protected	2✔
16
17	def require_profile_completion	2✔
18	return if skip_profile_completion_check?	780✔
19
NEW 20	redirect_to user_edit_path(current_user.id, return_to: dashboard_path),	×
21	alert: 'Please confirm your profile details before continuing.'
22	end
23
24	def skip_profile_completion_check?	2✔
25	!user_signed_in? \|\|	780✔
26	!Rails.configuration.x.auth.shibboleth_enabled \|\|
27	current_user.role.to_s == 'root_admin' \|\|
28	profile_complete? \|\|
29	on_allowed_profile_page? \|\|
30	devise_controller?
31	end
32
33	def profile_complete?	2✔
NEW UNCOV 34	current_user.department.present? && current_user.title.present?	×
35	end
36
37	def on_allowed_profile_page?	2✔
NEW UNCOV 38	controller_name == 'users' && %w[edit update].include?(action_name)	×
39	end
40
41	def configure_permitted_parameters	2✔
42	devise_parameter_sanitizer.permit(:sign_up,	78✔
43	keys: %i[first_name last_name department title email roles active])
44	devise_parameter_sanitizer.permit(:account_update,	78✔
45	keys: %i[first_name last_name department title email])
46	end
47	end

uclibs / application_portfolio / 25188412317

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous