app/models/polymorphic/task.rb in fat_free_crm-0.13.0 vs app/models/polymorphic/task.rb in fat_free_crm-0.13.1

@@ -25,10 +25,11 @@
 #  background_info :string(255)
 #
 
 class Task < ActiveRecord::Base
   attr_accessor :calendar
+  ALLOWED_VIEWS = %w(pending assigned completed)
 
   belongs_to :user
   belongs_to :assignee, :class_name => "User", :foreign_key => :assigned_to
   belongs_to :completor, :class_name => "User", :foreign_key => :completed_by
   belongs_to :asset, :polymorphic => true
@@ -44,12 +45,12 @@
     where('(user_id = ? AND assigned_to IS NULL) OR assigned_to = ?', user_option, user_option).
     order(options[:order] || 'name ASC').
     limit(options[:limit]) # nil selects all records
   }
 
-  scope :created_by,  ->(user) { where(:user_id => user.id) }
-  scope :assigned_to, ->(user) { where(:assigned_to => user.id) }
+  scope :created_by,  ->(user) { where( user_id: user.id ) }
+  scope :assigned_to, ->(user) { where( assigned_to: user.id ) }
 
   # Tasks assigned by the user to others. That's what we see on Tasks/Assigned.
   scope :assigned_by, ->(user) {
     includes(:assignee).
     where('user_id = ? AND assigned_to IS NOT NULL AND assigned_to != ?', user.id, user.id)
@@ -60,12 +61,12 @@
   scope :tracked_by, ->(user) {
     includes(:assignee).
     where('user_id = ? OR assigned_to = ?', user.id, user.id)
   }
 
+  # Show opportunities which either belong to the user and are unassigned, or are assigned to the user
   scope :visible_on_dashboard, ->(user) {
-    # Show opportunities which either belong to the user and are unassigned, or are assigned to the user
     where('(user_id = :user_id AND assigned_to IS NULL) OR assigned_to = :user_id', :user_id => user.id).where('completed_at IS NULL')
   }
 
   scope :by_due_at, -> {
       order({
@@ -169,10 +170,11 @@
   end
 
   # Returns list of tasks grouping them by due date as required by tasks/index.
   #----------------------------------------------------------------------------
   def self.find_all_grouped(user, view)
+    return {} unless ALLOWED_VIEWS.include?(view)
     settings = (view == "completed" ? Setting.task_completed : Setting.task_bucket)
     Hash[
       settings.map do |key, value|
         [ key, view == "assigned" ? assigned_by(user).send(key).pending : my(user).send(key).send(view) ]
       end
@@ -180,20 +182,21 @@
   end
 
   # Returns bucket if it's empty (i.e. we have to hide it), nil otherwise.
   #----------------------------------------------------------------------------
   def self.bucket_empty?(bucket, user, view = "pending")
-    return false if bucket.blank?
+    return false if bucket.blank? or !ALLOWED_VIEWS.include?(view)
     if view == "assigned"
       assigned_by(user).send(bucket).pending.count
     else
       my(user).send(bucket).send(view).count
     end == 0
   end
 
   # Returns task totals for each of the views as needed by tasks sidebar.
   #----------------------------------------------------------------------------
   def self.totals(user, view = "pending")
+    return {} unless ALLOWED_VIEWS.include?(view)
     settings = (view == "completed" ? Setting.task_completed : Setting.task_bucket)
     settings.inject({ :all => 0 }) do |hash, key|
       hash[key] = (view == "assigned" ? assigned_by(user).send(key).pending.count : my(user).send(key).send(view).count)
       hash[:all] += hash[key]
       hash