Astrian/FIT5032-Assignment
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

View the review

Browse Source
This commit is contained in:
Astrian Zheng 2023-10-19 16:16:12 +11:00
parent 9654264773
commit 3e0414ad1a
2 changed files with 34 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
FIT5032-Assignment/Controllers/AppointmentsController.cs
View File

@ -695,6 +695,15 @@ namespace FIT5032_Assignment.Controllers {
return Redirect("/Appointments/Index"); return Redirect("/Appointments/Index");
} }
// Prevent XSS attack
// Replace with < and >
var comment = collection["comment"];
comment = comment.Replace("<", "&lt;");
comment = comment.Replace(">", "&gt;");
// Prevent SQL injection
comment = comment.Replace("'", "''");
// Create review // Create review
var uuid = Guid.NewGuid().ToString(); var uuid = Guid.NewGuid().ToString();
Reviews newReview = new Reviews { Reviews newReview = new Reviews {
@ -702,7 +711,7 @@ namespace FIT5032_Assignment.Controllers {
patient = userProfile.uuid, patient = userProfile.uuid,
doctor = appointment.responsibleBy, doctor = appointment.responsibleBy,
score = Convert.ToInt32(collection["score"]), score = Convert.ToInt32(collection["score"]),
comment = collection["comment"], comment = comment,
reviewAt = DateTime.Now, reviewAt = DateTime.Now,
}; };
db.Reviews.Add(newReview); db.Reviews.Add(newReview);

25
FIT5032-Assignment/Views/Appointments/Review.cshtml
View File

@ -12,7 +12,7 @@
<h2>Rate the experience</h2> <h2>Rate the experience</h2>
@if (ViewBag.role == 1) { @if (ViewBag.role == 1 && ViewBag.reviewAvailable == false) {
<p>You are about to review the Doctor <b>@ViewBag.doctorUser.displayName</b></p> <p>You are about to review the Doctor <b>@ViewBag.doctorUser.displayName</b></p>
<form method="post"> <form method="post">
<input type="hidden" id="appointment" name="appointment" required value="@ViewBag.appointment.uuid" /> <input type="hidden" id="appointment" name="appointment" required value="@ViewBag.appointment.uuid" />
@ -38,6 +38,22 @@
</div> </div>
<button class="btn btn-primary" type="submit">Submit</button> <button class="btn btn-primary" type="submit">Submit</button>
</form> </form>
} else {
if (ViewBag.reviewAvailable == false) {
<p>Review not available yet.</p>
} else {
<div class="review">
<div><img src="@ViewBag.patient.avatar" style="width: 30px; border-radius: 50%; margin-right: 10px;" /><b>@ViewBag.patient.displayName</b> already reviewed this appointment.</div>
<div>
@if (ViewBag.review.score == 1) {
<span style="color: green;"><span class="material-symbols-outlined">thumb_up</span> <b>Recommended</b></span>
} else {
<span style="color: red;"><span class="material-symbols-outlined">thumb_down</span> <b>Not Recommended</b></span>
}
<span>@ViewBag.review.comment</span>
</div>
</div>
}
} }
@section Scripts { @section Scripts {
@ -50,6 +66,13 @@
textarea { textarea {
width: 100%; width: 100%;
} }
.review {
display: flex;
flex-direction: column;
/* Spacing between elements inside .review */
gap: 10px;
}
</style> </style>
<script> <script>
function rate(score) { function rate(score) {