Sudo Autocomplete

app/controllers/course_user_data_controller.rb

@@ -190,20 +190,25 @@ def sudo
       redirect_to([@cud.course]) && return
     end
 
-    return unless request.post?
-
-    sudo_user = User.where(email: params[:sudo_email]).first
-    unless sudo_user
-      flash[:error] = "User #{params[:sudo_email]} does not exist"
-      redirect_to(action: :sudo) && return
+    @users = {}
+    @usersEncoded = {}
+    @course.course_user_data.each do |cud|
+      # Prevent XSS inside autocomplete
+      @users[CGI.escapeHTML cud.full_name_with_email] = cud.id
+      # Why base64? See issue 931
+      @usersEncoded[Base64.urlsafe_encode64(cud.full_name_with_email.strip).strip] = cud.id
     end
 
-    sudo_cud = @course.course_user_data.where(user_id: sudo_user.id).first
+    return unless request.post?
+
+    sudo_cud = @course.course_user_data.where(id: params[:sudo_id]).first
     unless sudo_cud
-      flash[:error] = "User #{params[:sudo_email]} does not exist in the course"
+      flash[:error] = "User does not exist in the course"
       redirect_to(action: :sudo) && return
     end
 
+    sudo_user = User.where(id: sudo_cud.user_id).first
+
     unless @cud.can_sudo_to?(sudo_cud)
       flash[:error] = "You do not have the privileges to act as " \
               "#{sudo_cud.display_name}"

app/views/course_user_data/sudo.html.erb

@@ -1,10 +1,51 @@
+<% content_for :javascripts do %>
+
+  <script type="application/javascript">
+    jQuery(function() {
+      /* match user name/email with cud_email */
+      /* escape_javascript prevents issues with backslashes in names, etc. */
+      userData = {
+          <% @usersEncoded.each do |k,v| %>
+            "<%= j k %>": "<%= v %>",
+          <% end %>
+      };
+
+      /* user autocomplete */
+      $studentAutocompleteField = $('#student_autocomplete');
+      $hiddenCUDField = $('#sudo_id');
+      $studentAutocompleteField.autocomplete({
+        data: {
+          <% @users.each do |k,v| %>
+            "<%= j k %>": null,
+          <% end %>
+        }
+      });
+
+      /* track changes in student autocomplete field */
+      $studentAutocompleteField.on('change', function () {
+          // urlsafe_encode64 uses '-' instead of '+' and '_' instead of '/'
+          // so we have to replace the corresponding characters
+          encoded = window.btoa($studentAutocompleteField.val())
+          encoded = encoded.replace("+", "-")
+          encoded = encoded.replace("/", "_")
+          $hiddenCUDField.val(userData[encoded]);
+      });
+    });
+  </script>
+<% end %>
+
 <h2>Act as User</h2>
 
 <p>You can use sudo to examine how Autolab appears to other users. You can also change your permission levels to see what your course assistants or students generically see.</p>
 
-<p>
+<div>
 <%= form_tag do %>
-  Act as user (email): <%= email_field_tag :sudo_email %>
+  Act as user (email):
+  <div class="input-field">
+    <input type="text" size="3" id="student_autocomplete" class="autocomplete" autocomplete="off"/>
+    <label for="student_autocomplete">Start typing student name or email</label>
+  </div>
+  <%= hidden_field_tag(:sudo_id) %>
   <%= submit_tag "Sudo", {:value=>"Sudo", :class=> "btn primary"} %>
 <% end %>
-</p>
+</div>

app/views/submissions/new.html.erb

@@ -53,7 +53,7 @@
   <div class="input-field">
     <input type="text" size="3" id="student_autocomplete" class="autocomplete" autocomplete="off"/>
     <label for="student_autocomplete">Start typing student name or email</label>
-  </div><br>
+  </div>
   <%= f.hidden_field(:course_user_datum_id)%>
 
   <% else %>