19316: Change wb1 and sdk/cli to Oj.safe_load / strict_load.

[arvados.git] / apps / workbench / app / controllers / actions_controller.rb

diff --git a/apps/workbench/app/controllers/actions_controller.rb b/apps/workbench/app/controllers/actions_controller.rb
index 885f539363730514a7f5dccbb1df49fb1ab2b8e0..7b8c8eafc81d31cd566c6cef81e050b5ca521c9a 100644 (file)
--- a/apps/workbench/app/controllers/actions_controller.rb
+++ b/apps/workbench/app/controllers/actions_controller.rb
@@ -34,7 +34,7 @@ class ActionsController < ApplicationController
         @object.link_class == 'name' and
         ArvadosBase::resource_class_for_uuid(@object.head_uuid) == Collection
       redirect_to collection_path(id: @object.uuid)
-    elsif @object.is_a?(Group) and @object.group_class == 'project'
+    elsif @object.is_a?(Group) and (@object.group_class == 'project' or @object.group_class == 'filter')
       redirect_to project_path(id: @object.uuid)
     elsif @object
       redirect_to @object
@@ -49,7 +49,7 @@ class ActionsController < ApplicationController
         return self.send(param)
       end
     end
-    redirect_to :back
+    redirect_back(fallback_location: root_path)
   end
 
   expose_action :copy_selections_into_project do
@@ -87,6 +87,9 @@ class ActionsController < ApplicationController
             end
             if resource_class == Collection
               dst.manifest_text = Collection.select([:manifest_text]).where(uuid: src.uuid).with_count("none").first.manifest_text
+              # Fixes bug 19144: nullify some fields that are managed by keep-balance.
+              dst.storage_classes_confirmed = []
+              dst.storage_classes_confirmed_at = nil
             end
           when :move
             dst = src
@@ -164,7 +167,7 @@ class ActionsController < ApplicationController
     flash = {}
 
     # set owner_uuid to current project, provided it is writable
-    action_data = Oj.load(params['action_data'] || "{}")
+    action_data = Oj.safe_load(params['action_data'] || "{}")
     if action_data['current_project_uuid'] and
         current_project = Group.find?(action_data['current_project_uuid']) and
         current_project.writable_by.andand.include?(current_user.uuid)