Initial changes defense

AngKo_Catolico/election_2016/app/controllers/election_controller.rb

+class ElectionController < ApplicationController
+	def vote
+      @vote = Vote.new
+      @candidates = Candidate.all.group_by(&:position_id)
+
+      render "/votes/vote.html.erb"
+  	end
+
+  def confirm_vote
+    @vote = Vote.new(vote_params)
+    @vote.user = current_user
+
+    if @vote.save(vote_params)
+      if current_user.votes.count >= Position.count
+      redirect_to root_path, notice: "You have already exceeded your number of votes."
+      else
+      redirect_to :vote, notice: "Vote successful!"
+      end
+    else
+      render :vote
+    end
+  end
+
+  def vote_history
+    @votes = current_user.votes
+  end
+
+  private
+    def vote_params
+      params.require(:vote).permit!
+    end
+
+end
\ No newline at end of file

election_2016/app/views/votes/vote.html.erb → AngKo_Catolico/election_2016/app/views/votes/vote.html.erb

@@ -3,16 +3,19 @@
 <h1>Ballot</h1>
 
 <% @candidates.each do |position_id, candidates| %>
-<%= simple_form_for(@vote, url: confirm_vote_path, method: :post) do |o| %>
+<%= simple_form_for(@vote, url: "/election/vote/id:", method: :get) do |o| %>
 		
 			<%= Position.find(position_id).name %>
 				<ul> 
 					<li><%= o.association :candidate, :collection => candidates %></li>
-					<li><%= o.input :comments %></li>
 				</ul>
 				
+				<% if current_user.votes.count >= Position.count %>
+					<% link_to "Home", root_path %>
+				<% else %>
 					<%= o.button :submit, "Vote" %>
 				<% end %>
+		<% end %>
 		<%= link_to "Back to Home", candidates_list_path %>
 		
 <% end %>

election_2016/config/routes.rb → AngKo_Catolico/election_2016/config/routes.rb

@@ -5,6 +5,7 @@ Rails.application.routes.draw do
   get "/profiles", to: "votes#vote_history"
   get "/about", to: "pages#about"
   get "/index", to: "pages#index"
+  get "/election/vote/:id", to: "election#vote"
   resources :candidates
 
   get "/positions/:id", to: "positions#show"
@@ -19,4 +20,6 @@ Rails.application.routes.draw do
     resources :positions
     get "/positions/:id", to: "positions#show"
   end
+
+  #get "/election/vote/:id", to: "election#vote"
 end