Don't show http-only routers to users on https

[rails.git] / app / controllers / relation_controller.rb

diff --git a/app/controllers/relation_controller.rb b/app/controllers/relation_controller.rb
index f3c4c9f791357d7f046064794b6e6fd2a594627b..9e7466a4ad4f7506b5d165e4584e33aa5424ff87 100644 (file)
--- a/app/controllers/relation_controller.rb
+++ b/app/controllers/relation_controller.rb
@@ -1,13 +1,14 @@
 class RelationController < ApplicationController
   require 'xml/libxml'
 
-  session :off
+  skip_before_filter :verify_authenticity_token
   before_filter :authorize, :only => [:create, :update, :delete]
+  before_filter :require_allow_write_api, :only => [:create, :update, :delete]
   before_filter :require_public_data, :only => [:create, :update, :delete]
   before_filter :check_api_writable, :only => [:create, :update, :delete]
   before_filter :check_api_readable, :except => [:create, :update, :delete]
   after_filter :compress_output
-  around_filter :api_call_handle_error
+  around_filter :api_call_handle_error, :api_call_timeout
 
   def create
     assert_method :put
@@ -26,7 +27,7 @@ class RelationController < ApplicationController
 
   def read
     relation = Relation.find(params[:id])
-    response.headers['Last-Modified'] = relation.timestamp.rfc822
+    response.last_modified = relation.timestamp
     if relation.visible
       render :text => relation.to_xml.to_s, :content_type => "text/xml"
     else
@@ -44,7 +45,7 @@ class RelationController < ApplicationController
       relation.update_from new_relation, @user
       render :text => relation.version.to_s, :content_type => "text/plain"
     else
-      render :nothing => true, :status => :bad_request
+      render :text => "", :status => :bad_request
     end
   end
 
@@ -55,7 +56,7 @@ class RelationController < ApplicationController
       relation.delete_with_history!(new_relation, @user)
       render :text => relation.version.to_s, :content_type => "text/plain"
     else
-      render :nothing => true, :status => :bad_request
+      render :text => "", :status => :bad_request
     end
   end
 
@@ -81,8 +82,8 @@ class RelationController < ApplicationController
       
       # next load the relations and the ways.
       
-      relations = Relation.find(relation_ids, :include => [:relation_tags])
-      ways = Way.find(way_ids, :include => [:way_nodes, :way_tags])
+      relations = Relation.where(:id => relation_ids).includes(:relation_tags)
+      ways = Way.where(:id => way_ids).includes(:way_nodes, :way_tags)
       
       # now additionally collect nodes referenced by ways. Note how we 
       # recursively evaluate ways but NOT relations.
@@ -91,7 +92,7 @@ class RelationController < ApplicationController
         way.way_nodes.collect { |way_node| way_node.node_id }
       }
       node_ids += way_node_ids.flatten
-      nodes = Node.find(node_ids.uniq, :include => :node_tags)
+      nodes = Node.where(:id => node_ids.uniq).includes(:node_tags)
       
       # create XML.
       doc = OSM::API.new.get_xml_doc
@@ -124,24 +125,28 @@ class RelationController < ApplicationController
       render :text => doc.to_s, :content_type => "text/xml"
       
     else
-      render :nothing => true, :status => :gone
+      render :text => "", :status => :gone
     end
   end
 
   def relations
+    if not params['relations']
+      raise OSM::APIBadUserInput.new("The parameter relations is required, and must be of the form relations=id[,id[,id...]]")
+    end
+
     ids = params['relations'].split(',').collect { |w| w.to_i }
 
-    if ids.length > 0
-      doc = OSM::API.new.get_xml_doc
+    if ids.length == 0
+      raise OSM::APIBadUserInput.new("No relations were given to search for")
+    end
 
-      Relation.find(ids).each do |relation|
-        doc.root << relation.to_xml_node
-      end
+    doc = OSM::API.new.get_xml_doc
 
-      render :text => doc.to_s, :content_type => "text/xml"
-    else
-      render :text => "You need to supply a comma separated list of ids.", :status => :bad_request
+    Relation.find(ids).each do |relation|
+      doc.root << relation.to_xml_node
     end
+
+    render :text => doc.to_s, :content_type => "text/xml"
   end
 
   def relations_for_way
@@ -157,7 +162,7 @@ class RelationController < ApplicationController
   end
 
   def relations_for_object(objtype)
-    relationids = RelationMember.find(:all, :conditions => ['member_type=? and member_id=?', objtype, params[:id]]).collect { |ws| ws.id[0] }.uniq
+    relationids = RelationMember.where(:member_type => objtype, :member_id => params[:id]).collect { |ws| ws.relation_id }.uniq
 
     doc = OSM::API.new.get_xml_doc