From e147a34664ea27d2510118355214518289f4272a Mon Sep 17 00:00:00 2001
From: evazion <noizave@gmail.com>
Date: Sun, 25 Aug 2019 21:28:32 -0500
Subject: [PATCH] pool orders: disable drag-and-drop ordering for pools with
 >100 posts.

Previously if a pool had >100 posts then the 'Order' link wouldn't
appear in the navbar, but it was still possible to visit the pool order
page directly. If a user did so, only the first 100 posts in the pool
would be shown in the drag-and-drop widget. If they tried to reorder the
pool anyway, then everything beyond the first 100 posts would be
silently removed from the pool.

Now we always show the 'Order' link, but we disable the drag-and-drop
reordering widget when the pool has >100 posts to prevent posts from
being silently removed.
---
 app/models/pool.rb                        |  1 +
 app/views/pool_orders/edit.html.erb       | 27 ++++++++++++++---------
 app/views/pools/_secondary_links.html.erb |  2 +-
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/app/models/pool.rb b/app/models/pool.rb
index b55c074a9..f862d753c 100644
--- a/app/models/pool.rb
+++ b/app/models/pool.rb
@@ -1,5 +1,6 @@
 class Pool < ApplicationRecord
   class RevertError < Exception ; end
+  POOL_ORDER_LIMIT = 100
 
   array_attribute :post_ids, parse: /\d+/, cast: :to_i
   belongs_to_creator
diff --git a/app/views/pool_orders/edit.html.erb b/app/views/pool_orders/edit.html.erb
index 936a4d2ef..b31be6a06 100644
--- a/app/views/pool_orders/edit.html.erb
+++ b/app/views/pool_orders/edit.html.erb
@@ -1,20 +1,27 @@
 <div id="c-pool-orders">
   <div id="a-edit">
     <h1>Order Pool: <%= @pool.pretty_name %></h1>
-    <p>Drag and drop the list below to determine ordering.</p>
 
-    <%= render "posts/partials/common/inline_blacklist" %>
+    <%= simple_form_for(@pool, format: :js, html: { id: "ordering-form" }) do |f| %>
+      <% if @pool.post_count <= Pool::POOL_ORDER_LIMIT %>
+        <p>Drag and drop the list below to determine ordering.</p>
 
-    <ul id="sortable">
-      <% @pool.posts.limit(100).each do |post| %>
-        <li class="ui-state-default" id="pool[post_ids]_<%= post.id %>">
-          <%= PostPresenter.preview(post).presence || "Hidden: Post ##{post.id}" %>
-        </li>
+        <%= render "posts/partials/common/inline_blacklist" %>
+
+        <ul id="sortable">
+          <% @pool.posts.each do |post| %>
+            <li class="ui-state-default" id="pool[post_ids]_<%= post.id %>">
+              <%= PostPresenter.preview(post).presence || "Hidden: Post ##{post.id}" %>
+            </li>
+          <% end %>
+        </ul>
+      <% else %>
+        <p>Reorder the post IDs in the text box below to reorder the pool.</p>
+
+        <%= f.input :post_ids_string, as: :text, label: "Posts" %>
       <% end %>
-    </ul>
 
-    <%= simple_form_for(@pool, :format => :js, :html => {:id => "ordering-form"}) do |f| %>
-      <%= submit_tag "Save" %>
+      <%= f.submit "Save" %>
     <% end %>
   </div>
 </div>
diff --git a/app/views/pools/_secondary_links.html.erb b/app/views/pools/_secondary_links.html.erb
index 13df4cc1b..60cf343b3 100644
--- a/app/views/pools/_secondary_links.html.erb
+++ b/app/views/pools/_secondary_links.html.erb
@@ -22,7 +22,7 @@
       <% if PoolArchive.enabled? %>
         <%= subnav_link_to "History", pool_versions_path(:search => {:pool_id => @pool.id}) %>
       <% end %>
-      <% if @pool.post_count <= 100 && CurrentUser.is_member? %>
+      <% if CurrentUser.is_member? %>
         <%= subnav_link_to "Order", edit_pool_order_path(@pool) %>
       <% end %>
     <% end %>