Prevent CSRF bypass unblocking users

[rails.git] / app / views / browse / note.html.erb

diff --git a/app/views/browse/note.html.erb b/app/views/browse/note.html.erb
index 12de1114f654f67d106a48e789f353a54208c442..1a792e873952ce3dc98b5d6b7ced79e6f27cdeb2 100644 (file)
--- a/app/views/browse/note.html.erb
+++ b/app/views/browse/note.html.erb
@@ -1,57 +1,76 @@
-<%= render :partial => "navigation" %>
+<% set_title(t(".title", :id => @note.id)) %>
 
-<h2>
-  <%= image_tag "#{@note.status}_note_marker.png", :alt => @note.status %>
-  <%= t "browse.note.#{@note.status}_title", :note_name => @note.id %>
-</h2>
+<%= render "sidebar_header", :title => t(".#{@note.status}_title", :note_name => @note.id) %>
 
-<%= render :partial => "map", :object => @note %>
+<div class="browse-section">
+  <h4><%= t(".description") %></h4>
+  <div class="note-description">
+    <%= h(@note_comments.first.body.to_html) %>
+  </div>
 
-<table class="browse_details">
+  <div class="details" data-coordinates="<%= @note.lat %>,<%= @note.lon %>" data-status="<%= @note.status %>">
+    <ul class="list-unstyled">
+      <li><%= note_event("opened", @note.created_at, @note.author) %></li>
+      <% if @note.status == "closed" %>
+        <li><%= note_event(@note.status, @note.closed_at, @note.all_comments.last.author) %></li>
+      <% end %>
+      <li>
+        <%= t "browse.location" %>
+        <%= link_to(t(".coordinates_html",
+                      :latitude => tag.span(number_with_delimiter(@note.lat), :class => "latitude"),
+                      :longitude => tag.span(number_with_delimiter(@note.lon), :class => "longitude")),
+                    root_path(:anchor => "map=18/#{@note.lat}/#{@note.lon}")) %>
+      </li>
+    </ul>
+  </div>
 
-  <tr>
-    <th><%= t "browse.note.opened" %></th>
-    <td><%= t "browse.note.at_by_html", :when => friendly_date(@note.created_at), :user => note_author(@note) %></td>
-  </tr>  
+  <% if @note_comments.find { |comment| comment.author.nil? } -%>
+    <p class='alert alert-warning'><%= t "javascripts.notes.show.anonymous_warning" %></p>
+  <% end -%>
 
-  <% if @note.status == "closed" %>
-    <tr>
-      <th><%= t "browse.note.closed" %></th>
-      <td><%= t "browse.note.at_by_html", :when => friendly_date(@note.closed_at), :user => note_author(@note.comments.last) %></td>
-    </tr>  
-  <% elsif @note.comments.length > 1 %>
-    <tr>
-      <th><%= t "browse.note.last_modified" %></th>
-      <td><%= t "browse.note.at_by_html", :when => friendly_date(@note.updated_at), :user => note_author(@note.comments.last) %></td>
-    </tr>  
+  <% if current_user && current_user != @note.author %>
+    <p class="text-muted"><%= report_link(t(".report"), @note) %></p>
   <% end %>
 
-  <tr>
-    <th><%= t "browse.note.description" %></th>
-    <td><%= h(@note.comments.first.body) %></td>
-  </tr>
-
-  <tr>
-    <th><%= t "browse.node_details.coordinates" %></th>
-    <td><div class="geo"><%= link_to ("<span class='latitude'>#{number_with_delimiter(@note.lat)}</span>, <span class='longitude'>#{number_with_delimiter(@note.lon)}</span>".html_safe), {:controller => 'site', :action => 'index', :lat => h(@note.lat), :lon => h(@note.lon), :zoom => "18"} %></div></td>
-  </tr>
-
-  <% if @note.comments.length > 1 %>
-    <tr valign="top">
-      <th><%= t "browse.note.comments" %></th>
-      <td class="browse_comments">
-        <table>
-          <% @note.comments[1..-1].each do |comment| %>
-            <tr>
-              <td>
-                <%= comment.body.to_html %>
-                <span class="by"><%= t "browse.note.at_by_html", :when => friendly_date(comment.created_at), :user => note_author(comment) %></span>
-              </td>
-            </tr>
-          <% end %>
-        </table>
-      </td>
-    </tr>
+  <% if @note_comments.length > 1 %>
+    <div class='note-comments'>
+      <ul class="list-unstyled">
+        <% @note_comments.drop(1).each do |comment| %>
+          <li id="c<%= comment.id %>">
+            <small class='text-muted'><%= note_event(comment.event, comment.created_at, comment.author) %></small>
+            <%= comment.body.to_html %>
+          </li>
+        <% end %>
+      </ul>
+    </div>
   <% end %>
 
-</table>
+  <% if @note.status == "open" %>
+    <% if current_user -%>
+      <form action="#">
+        <div class="form-group">
+          <textarea class="form-control" name="text" cols="40" rows="5" maxlength="2000"></textarea>
+        </div>
+        <div>
+          <% if current_user.moderator? -%>
+            <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+          <% end -%>
+          <input type="submit" name="close" value="<%= t("javascripts.notes.show.resolve") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= close_note_url(@note, "json") %>">
+          <input type="submit" name="comment" value="<%= t("javascripts.notes.show.comment") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= comment_note_url(@note, "json") %>" disabled="1">
+        </div>
+      </form>
+    <% end -%>
+  <% else %>
+    <form action="#">
+      <input type="hidden" name="text" value="">
+      <div>
+        <% if current_user and current_user.moderator? -%>
+          <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+        <% end -%>
+        <% if current_user -%>
+          <input type="submit" name="reopen" value="<%= t("javascripts.notes.show.reactivate") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= reopen_note_url(@note, "json") %>">
+        <% end -%>
+      </div>
+    </form>
+  <% end %>
+</div>