views:

28

answers:

2

I am implementing a simple RoR webpage that collect emails from visitors and store them as objects.

I'm using it as a mini-project to try RoR and BDD. I can think of 3 features for Cucumber: 1. User submits a valid email address 2. User submits an existing email address 3. User submits an invalid email

My question is, for scenarios 2 and 3, is it better to handle this via the controller? or as methods in a class? Perhaps something that throws errors if an instance is instantiated in sceanrio 2 or 3?

Implementation is below, love to hear some code reviews in addition to answers to questions above. Thanks!


MODEL:

class Contact < ActiveRecord::Base
    attr_accessor :email
end

VIEW:

<h1>Welcome To My Experiment</h1>
<p>Find me in app/views/welcome/index.html.erb</p>

<%= flash[:notice] %>

<% form_for @contact, :url => {:action => "index"} do |f| %>
<%= f.label :email %><br />
<%= f.text_field :email %>
<%= submit_tag 'Submit' %>
<% end %>

CONTROLLER:

class WelcomeController < ApplicationController
  def index
    @contact = Contact.new
    unless params[:contact].nil?
      @contact = Contact.create!(params[:contact])
      flash[:notice] = "Thank you for your interest, please check your mailbox for confirmation"
    end  
  end
end
A: 

To perform the last two steps, I recommend you use rails validations. For example, try updating your model to look something like this:

class Contact < ActiveRecord::Base

  attr_accessor :email

  validates_uniqueness_of :email
  validates_format_of :email, :with => /\A(\S+)@(\S+)\Z/i

end
Kevin Sylvestre
Ah thanks! That makes sense. When I add in the code though, I get the following error:undefined method `text?' for nil:NilClassTraces to: /welcome_controller.rb:5:in `index'Any clue what this error is about?
Tian
Not sure. What is on line 5 of your welcome_controller?
Kevin Sylvestre
@contact = Contact.create!(params[:contact])
Tian
A: 

On another note, it is considered bad practice to bulk assign values coming back from the "params" to your model. It does allow for devious people to do unsavory things to your system sometimes.

That's the whole reason `attr_protected` and `attr_accessible` exist. Bulk assignment itself is not bad practice.
x1a4
Thanks for the clarification. I did a little searching and found that but not doing attr_protected and using bulk assignment, that woud allow creating admin accounts for example. What are ways that it could be abused. Seigel, what is the solution that you normally use?
Tian
Just found a good link on this topichttp://b.lesseverything.com/2008/3/11/use-attr_protected-or-we-will-hack-you
Tian
Just attr_protected all variables relating to your admin access (i.e. if you have a boolean variable indicating if a user is an administrator, ensure it is protected).
Kevin Sylvestre
I think kevin has a good example. I usually take the values I expect from the parameters and assign them. Also sounds like x1a4 has an interesting take on the solution as well. I've never seen/used those methods.