Get rid of custom CSRF protection for user role changes

[rails.git] / app / controllers / way_controller.rb

diff --git a/app/controllers/way_controller.rb b/app/controllers/way_controller.rb
index 2cd7abf604b6a37f13248ba9f1fd2db1661e943e..c3ffe3c0f457f488c899c2fbd2f1bf67858e4f22 100644 (file)
--- a/app/controllers/way_controller.rb
+++ b/app/controllers/way_controller.rb
@@ -1,8 +1,9 @@
 class WayController < ApplicationController
   require 'xml/libxml'
 
-  session :off
+  skip_before_filter :verify_authenticity_token
   before_filter :authorize, :only => [:create, :update, :delete]
+  before_filter :require_allow_write_api, :only => [:create, :update, :delete]
   before_filter :require_public_data, :only => [:create, :update, :delete]
   before_filter :check_api_writable, :only => [:create, :update, :delete]
   before_filter :check_api_readable, :except => [:create, :update, :delete]
@@ -25,7 +26,7 @@ class WayController < ApplicationController
   def read
     way = Way.find(params[:id])
     
-    response.headers['Last-Modified'] = way.timestamp.rfc822
+    response.last_modified = way.timestamp
     
     if way.visible
       render :text => way.to_xml.to_s, :content_type => "text/xml"
@@ -60,14 +61,14 @@ class WayController < ApplicationController
   end
 
   def full
-    way = Way.find(params[:id], :include => {:nodes => :node_tags})
+    way = Way.includes(:nodes => :node_tags).find(params[:id])
     
     if way.visible
       changeset_cache = {}
       user_display_name_cache = {}
 
       doc = OSM::API.new.get_xml_doc
-      way.nodes.each do |node|
+      way.nodes.uniq.each do |node|
         if node.visible
           doc.root << node.to_xml_node(changeset_cache, user_display_name_cache)
         end
@@ -105,9 +106,7 @@ class WayController < ApplicationController
   # :id parameter. note that this used to return deleted ways as well, but
   # this seemed not to be the expected behaviour, so it was removed.
   def ways_for_node
-    wayids = WayNode.find(:all, 
-                          :conditions => ['node_id = ?', params[:id]]
-                          ).collect { |ws| ws.id[0] }.uniq
+    wayids = WayNode.where(:node_id => params[:id]).collect { |ws| ws.id[0] }.uniq
 
     doc = OSM::API.new.get_xml_doc