app/controllers/documents_v2_controller.rb
def create
    new_doc_is_shared = params[:shared].present? ? params[:shared] == 'true' : false

    if ENV['SHARED_DOCS_DISABLED'] && new_doc_is_shared
      render_shared_docs_error && return
    end

    if params[:source].present?
      @document = Document.find_by(id: params[:source])
      render_not_found && return unless @document

      if !@document.shared
        if params[:accessKey].present?
          access_key = parse_access_key
          render_invalid_access_key_format && return unless access_key.valid_format?
          # both read-only or read-write access keys are acceptable so no need to check the type
          render_invalid_access_key && return unless valid_document_access_key(access_key)
        else
          render(json: {valid: false, errors: ["Source document is not shared and no accessKey parameter is present."], message: "error.notShared"}, status: 403) && return
        end
      end

      copy = Document.new
      copy.title = @document.title
      copy.content = @document.content
      copy.original_content = @document.content
      copy.shared = new_doc_is_shared
      copy.owner = nil
      create_access_keys(copy)
      if copy.save
        render json: {status: "Copied", valid: true, id: copy.id, readAccessKey: copy.read_access_key, readWriteAccessKey: copy.read_write_access_key}, status: 201
      else
        render json: {status: "Error", errors: copy.errors.full_messages + copy.contents.errors.full_messages, valid: false, message: 'error.writeFailed' }, status: 400
      end
    else
      @document = Document.new
      @document.form_content = request.raw_post
      @document.original_content = @document.content
      @document.shared = new_doc_is_shared
      @document.owner = nil
      create_access_keys(@document)
      if @document.save
        render json: {status: "Created", valid: true, id: @document.id, readAccessKey: @document.read_access_key, readWriteAccessKey: @document.read_write_access_key}, status: 201
      else
        render json: {status: "Error", errors: @document.errors.full_messages + @document.contents.errors.full_messages, valid: false, message: 'error.writeFailed' }, status: 400
      end
    end
  end
# don't check for csrf token
don't check for csrf token
don ' t check for csrf token
def create
    new_doc_is_shared = params[:shared].present? ? params[:shared] == 'true' : false
    if ENV['SHARED_DOCS_DISABLED'] && new_doc_is_shared
      render_shared_docs_error && return
    end
    if params[:source].present?
      @document = Document.find_by(id: params[:source])
      render_not_found && return unless @document
      if !@document.shared
        if params[:accessKey].present?
          access_key = parse_access_key
          render_invalid_access_key_format && return unless access_key.valid_format?
          render_invalid_access_key && return unless valid_document_access_key(access_key)
        else
          render(json: {valid: false, errors: ["Source document is not shared and no accessKey parameter is present."], message: "error.notShared"}, status: 403) && return
        end
      end
      copy = Document.new
      copy.title = @document.title
      copy.content = @document.content
      copy.original_content = @document.content
      copy.shared = new_doc_is_shared
      copy.owner = nil
      create_access_keys(copy)
      if copy.save
        render json: {status: "Copied", valid: true, id: copy.id, readAccessKey: copy.read_access_key, readWriteAccessKey: copy.read_write_access_key}, status: 201
      else
        render json: {status: "Error", errors: copy.errors.full_messages + copy.contents.errors.full_messages, valid: false, message: 'error.writeFailed' }, status: 400
      end
    else
      @document = Document.new
      @document.form_content = request.raw_post
      @document.original_content = @document.content
      @document.shared = new_doc_is_shared
      @document.owner = nil
      create_access_keys(@document)
      if @document.save
        render json: {status: "Created", valid: true, id: @document.id, readAccessKey: @document.read_access_key, readWriteAccessKey: @document.read_write_access_key}, status: 201
      else
        render json: {status: "Error", errors: @document.errors.full_messages + @document.contents.errors.full_messages, valid: false, message: 'error.writeFailed' }, status: 400
      end
    end
  end
def create new_doc_is_shared = params [ :shared ] . present? ? params [ :shared ] == 'true' : false if ENV [ 'SHARED_DOCS_DISABLED' ] && new_doc_is_shared render_shared_docs_error && return end if params [ :source ] . present? @document = Document . find_by ( id : params [ :source ] ) render_not_found && return unless @document if ! @document . shared if params [ :accessKey ] . present? access_key = parse_access_key render_invalid_access_key_format && return unless access_key . valid_format? render_invalid_access_key && return unless valid_document_access_key ( access_key ) else render ( json : { valid : false , errors : [ "Source document is not shared and no accessKey parameter is present." ] , message : "error.notShared" } , status : 403 ) && return end end copy = Document . new copy . title = @document . title copy . content = @document . content copy . original_content = @document . content copy . shared = new_doc_is_shared copy . owner = nil create_access_keys ( copy ) if copy . save render json : { status : "Copied" , valid : true , id : copy . id , readAccessKey : copy . read_access_key , readWriteAccessKey : copy . read_write_access_key } , status : 201 else render json : { status : "Error" , errors : copy . errors . full_messages + copy . contents . errors . full_messages , valid : false , message : 'error.writeFailed' } , status : 400 end else @document = Document . new @document . form_content = request . raw_post @document . original_content = @document . content @document . shared = new_doc_is_shared @document . owner = nil create_access_keys ( @document ) if @document . save render json : { status : "Created" , valid : true , id : @document . id , readAccessKey : @document . read_access_key , readWriteAccessKey : @document . read_write_access_key } , status : 201 else render json : { status : "Error" , errors : @document . errors . full_messages + @document . contents . errors . full_messages , valid : false , message : 'error.writeFailed' } , status : 400 end end end
don't check for csrf token
don ' t check for csrf token
# both read-only or read-write access keys are acceptable so no need to check the type