Merge remote-tracking branch 'upstream/pull/2072'

[rails.git] / app / controllers / changeset_comments_controller.rb

diff --git a/app/controllers/changeset_comments_controller.rb b/app/controllers/changeset_comments_controller.rb
index 31e152560af73d8fe0353a41fc6141822044a8b8..a3023af3eb3fd6e057781f4028e1d9c4bf28c6eb 100644 (file)
--- a/app/controllers/changeset_comments_controller.rb
+++ b/app/controllers/changeset_comments_controller.rb
@@ -1,20 +1,23 @@
 class ChangesetCommentsController < ApplicationController
 class ChangesetCommentsController < ApplicationController

-  before_action :authorize_web, :only => [:comments_feed]
-  before_action :set_locale, :only => [:comments_feed]
-  before_action :authorize, :only => [:comment, :hide_comment, :unhide_comment]
-  before_action :require_moderator, :only => [:hide_comment, :unhide_comment]
-  before_action :require_allow_write_api, :only => [:comment, :hide_comment, :unhide_comment]
-  before_action :require_public_data, :only => [:comment]
-  before_action :check_api_writable, :only => [:comment, :hide_comment, :unhide_comment]
-  before_action :check_api_readable, :except => [:comment, :comments_feed]
-  before_action(:only => [:comments_feed]) { |c| c.check_database_readable(true) }
-  around_action :api_call_handle_error, :except => [:comments_feed]
-  around_action :api_call_timeout, :except => [:comments_feed]
-  around_action :web_timeout, :only => [:comments_feed]
+  skip_before_action :verify_authenticity_token, :except => [:index]
+  before_action :authorize_web, :only => [:index]
+  before_action :set_locale, :only => [:index]
+  before_action :authorize, :only => [:create, :destroy, :restore]
+  before_action :api_deny_access_handler, :only => [:create, :destroy, :restore]
+
+  authorize_resource
+
+  before_action :require_public_data, :only => [:create]
+  before_action :check_api_writable, :only => [:create, :destroy, :restore]
+  before_action :check_api_readable, :except => [:create, :index]
+  before_action(:only => [:index]) { |c| c.check_database_readable(true) }
+  around_action :api_call_handle_error, :except => [:index]
+  around_action :api_call_timeout, :except => [:index]
+  around_action :web_timeout, :only => [:index]

 
   ##
   # Add a comment to a changeset
 
   ##
   # Add a comment to a changeset

-  def comment
+  def create

     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
     raise OSM::APIBadUserInput, "No text was given" if params[:text].blank?
     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
     raise OSM::APIBadUserInput, "No text was given" if params[:text].blank?


@@ -46,7 +49,7 @@ class ChangesetCommentsController < ApplicationController
 
   ##
   # Sets visible flag on comment to false
 
   ##
   # Sets visible flag on comment to false

-  def hide_comment
+  def destroy

     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
 
     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
 


@@ -65,7 +68,7 @@ class ChangesetCommentsController < ApplicationController
 
   ##
   # Sets visible flag on comment to true
 
   ##
   # Sets visible flag on comment to true

-  def unhide_comment
+  def restore

     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
 
     # Check the arguments are sane
     raise OSM::APIBadUserInput, "No id was given" unless params[:id]
 


@@ -84,7 +87,7 @@ class ChangesetCommentsController < ApplicationController
 
   ##
   # Get a feed of recent changeset comments
 
   ##
   # Get a feed of recent changeset comments

-  def comments_feed
+  def index

     if params[:id]
       # Extract the arguments
       id = params[:id].to_i
     if params[:id]
       # Extract the arguments
       id = params[:id].to_i