Potlatch 2 imagery update

[rails.git] / app / controllers / user_preference_controller.rb

diff --git a/app/controllers/user_preference_controller.rb b/app/controllers/user_preference_controller.rb
index 68ea88eeac5922def89f7e7e947f73c68332e072..377e78313ef3dde90ba92a69d174ce32afa9fc4f 100644 (file)
--- a/app/controllers/user_preference_controller.rb
+++ b/app/controllers/user_preference_controller.rb
@@ -1,6 +1,9 @@
 # Update and read user preferences, which are arbitrayr key/val pairs
 class UserPreferenceController < ApplicationController
 # Update and read user preferences, which are arbitrayr key/val pairs
 class UserPreferenceController < ApplicationController

+  skip_before_filter :verify_authenticity_token

   before_filter :authorize
   before_filter :authorize

+  before_filter :require_allow_read_prefs, :only => [:read_one, :read]
+  before_filter :require_allow_write_prefs, :except => [:read_one, :read]

 
   def read_one
     pref = UserPreference.find(@user.id, params[:preference_key])
 
   def read_one
     pref = UserPreference.find(@user.id, params[:preference_key])


@@ -52,7 +55,11 @@ class UserPreferenceController < ApplicationController
 
   # update the entire set of preferences
   def update
 
   # update the entire set of preferences
   def update

-    p = XML::Parser.string(request.raw_post)
+    begin
+      p = XML::Parser.string(request.raw_post)
+    rescue LibXML::XML::Error, ArgumentError => ex
+      raise OSM::APIBadXMLError.new("preferences", xml, ex.message)
+    end

     doc = p.parse
 
     prefs = []
     doc = p.parse
 
     prefs = []