Implement the cancan filters for diary entries

[rails.git] / app / controllers / user_controller.rb

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index a6a78f19290d58aba9f444da96a7b7406f07e13a..d853d4822979b6ab956a166cd6946c12f5f7e752 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -1,6 +1,8 @@
 class UserController < ApplicationController
   layout "site", :except => [:api_details]
 
 class UserController < ApplicationController
   layout "site", :except => [:api_details]
 

+  skip_authorization_check :only => [:login, :logout]
+

   skip_before_action :verify_authenticity_token, :only => [:api_read, :api_details, :api_gpx_files, :auth_success]
   before_action :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details]
   before_action :authorize, :only => [:api_details, :api_gpx_files]
   skip_before_action :verify_authenticity_token, :only => [:api_read, :api_details, :api_gpx_files, :auth_success]
   before_action :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details]
   before_action :authorize, :only => [:api_details, :api_gpx_files]


@@ -18,6 +20,7 @@ class UserController < ApplicationController
   around_action :api_call_handle_error, :only => [:api_read, :api_details, :api_gpx_files]
   before_action :lookup_user_by_id, :only => [:api_read]
   before_action :lookup_user_by_name, :only => [:set_status, :delete]
   around_action :api_call_handle_error, :only => [:api_read, :api_details, :api_gpx_files]
   before_action :lookup_user_by_id, :only => [:api_read]
   before_action :lookup_user_by_name, :only => [:set_status, :delete]

+  before_action :allow_thirdparty_images, :only => [:view, :account]

 
   def terms
     @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || DEFAULT_LEGALE
 
   def terms
     @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || DEFAULT_LEGALE


@@ -44,9 +47,7 @@ class UserController < ApplicationController
       if current_user
         current_user.terms_seen = true
 
       if current_user
         current_user.terms_seen = true
 

-        if current_user.save
-          flash[:notice] = t("user.new.terms declined", :url => t("user.new.terms declined url")).html_safe
-        end
+        flash[:notice] = t("user.new.terms declined", :url => t("user.new.terms declined url")).html_safe if current_user.save

 
         if params[:referer]
           redirect_to params[:referer]
 
         if params[:referer]
           redirect_to params[:referer]


@@ -99,7 +100,7 @@ class UserController < ApplicationController
                                        "lat" => m[2],
                                        "lon" => m[3] }.merge(editor))
             end
                                        "lat" => m[2],
                                        "lon" => m[3] }.merge(editor))
             end

-          rescue
+          rescue StandardError

             # Use default
           end
 
             # Use default
           end
 


@@ -119,7 +120,6 @@ class UserController < ApplicationController
   end
 
   def account
   end
 
   def account

-    @title = t "user.account.title"

     @tokens = current_user.oauth_tokens.authorized
 
     if params[:user] && params[:user][:display_name] && params[:user][:description]
     @tokens = current_user.oauth_tokens.authorized
 
     if params[:user] && params[:user][:display_name] && params[:user][:description]


@@ -136,6 +136,7 @@ class UserController < ApplicationController
         current_user.errors.add(attribute, error)
       end
     end
         current_user.errors.add(attribute, error)
       end
     end

+    @title = t "user.account.title"

   end
 
   def go_public
   end
 
   def go_public


@@ -202,6 +203,10 @@ class UserController < ApplicationController
     @title = t "user.new.title"
     @referer = params[:referer] || session[:referer]
 
     @title = t "user.new.title"
     @referer = params[:referer] || session[:referer]
 

+    append_content_security_policy_directives(
+      :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org]
+    )
+

     if current_user
       # The user is logged in already, so don't show them the signup
       # page, instead send them to the home page
     if current_user
       # The user is logged in already, so don't show them the signup
       # page, instead send them to the home page


@@ -220,6 +225,8 @@ class UserController < ApplicationController
       flash.now[:notice] = render_to_string :partial => "auth_association"
     else
       check_signup_allowed
       flash.now[:notice] = render_to_string :partial => "auth_association"
     else
       check_signup_allowed

+
+      self.current_user = User.new

     end
   end
 
     end
   end
 


@@ -372,7 +379,7 @@ class UserController < ApplicationController
   end
 
   def api_read
   end
 
   def api_read

-    if @this_user.visible?
+    if @user.visible?

       render :action => :api_read, :content_type => "text/xml"
     else
       head :gone
       render :action => :api_read, :content_type => "text/xml"
     else
       head :gone


@@ -380,7 +387,7 @@ class UserController < ApplicationController
   end
 
   def api_details
   end
 
   def api_details

-    @this_user = current_user
+    @user = current_user

     render :action => :api_read, :content_type => "text/xml"
   end
 
     render :action => :api_read, :content_type => "text/xml"
   end
 


@@ -393,11 +400,11 @@ class UserController < ApplicationController
   end
 
   def view
   end
 
   def view

-    @this_user = User.find_by(:display_name => params[:display_name])
+    @user = User.find_by(:display_name => params[:display_name])

 
 

-    if @this_user &&
-       (@this_user.visible? || (current_user && current_user.administrator?))
-      @title = @this_user.display_name
+    if @user &&
+       (@user.visible? || (current_user && current_user.administrator?))
+      @title = @user.display_name

     else
       render_unknown_user params[:display_name]
     end
     else
       render_unknown_user params[:display_name]
     end


@@ -409,8 +416,8 @@ class UserController < ApplicationController
     if @new_friend
       if request.post?
         friend = Friend.new
     if @new_friend
       if request.post?
         friend = Friend.new

-        friend.user_id = current_user.id
-        friend.friend_user_id = @new_friend.id
+        friend.befriender = current_user
+        friend.befriendee = @new_friend

         if current_user.is_friends_with?(@new_friend)
           flash[:warning] = t "user.make_friend.already_a_friend", :name => @new_friend.display_name
         elsif friend.save
         if current_user.is_friends_with?(@new_friend)
           flash[:warning] = t "user.make_friend.already_a_friend", :name => @new_friend.display_name
         elsif friend.save


@@ -457,15 +464,15 @@ class UserController < ApplicationController
   ##
   # sets a user's status
   def set_status
   ##
   # sets a user's status
   def set_status

-    @this_user.status = params[:status]
-    @this_user.save
+    @user.status = params[:status]
+    @user.save

     redirect_to :action => "view", :display_name => params[:display_name]
   end
 
   ##
   # delete a user, marking them as deleted and removing personal data
   def delete
     redirect_to :action => "view", :display_name => params[:display_name]
   end
 
   ##
   # delete a user, marking them as deleted and removing personal data
   def delete

-    @this_user.delete
+    @user.delete

     redirect_to :action => "view", :display_name => params[:display_name]
   end
 
     redirect_to :action => "view", :display_name => params[:display_name]
   end
 


@@ -526,9 +533,7 @@ class UserController < ApplicationController
       session[:new_user].auth_provider = provider
       session[:new_user].auth_uid = uid
 
       session[:new_user].auth_provider = provider
       session[:new_user].auth_uid = uid
 

-      if email_verified && email == session[:new_user].email
-        session[:new_user].status = "active"
-      end
+      session[:new_user].status = "active" if email_verified && email == session[:new_user].email

 
       redirect_to :action => "terms"
     else
 
       redirect_to :action => "terms"
     else


@@ -547,7 +552,7 @@ class UserController < ApplicationController
         when "active", "confirmed" then
           successful_login(user, request.env["omniauth.params"]["referer"])
         when "suspended" then
         when "active", "confirmed" then
           successful_login(user, request.env["omniauth.params"]["referer"])
         when "suspended" then

-          failed_login t("user.login.account is suspended", :webmaster => "mailto:#{SUPPORT_EMAIL}")
+          failed_login t("user.login.account is suspended", :webmaster => "mailto:#{SUPPORT_EMAIL}").html_safe

         else
           failed_login t("user.login.auth failure")
         end
         else
           failed_login t("user.login.auth failure")
         end


@@ -575,7 +580,7 @@ class UserController < ApplicationController
     elsif user = User.authenticate(:username => username, :password => password, :pending => true)
       unconfirmed_login(user)
     elsif User.authenticate(:username => username, :password => password, :suspended => true)
     elsif user = User.authenticate(:username => username, :password => password, :pending => true)
       unconfirmed_login(user)
     elsif User.authenticate(:username => username, :password => password, :suspended => true)

-      failed_login t("user.login.account is suspended", :webmaster => "mailto:#{SUPPORT_EMAIL}"), username
+      failed_login t("user.login.account is suspended", :webmaster => "mailto:#{SUPPORT_EMAIL}").html_safe, username

     else
       failed_login t("user.login.auth failure"), username
     end
     else
       failed_login t("user.login.auth failure"), username
     end


@@ -709,7 +714,7 @@ class UserController < ApplicationController
     end
 
     if user.save
     end
 
     if user.save

-      set_locale
+      set_locale(true)

 
       if user.new_email.blank? || user.new_email == user.email
         flash.now[:notice] = t "user.account.flash update success"
 
       if user.new_email.blank? || user.new_email == user.email
         flash.now[:notice] = t "user.account.flash update success"


@@ -721,7 +726,7 @@ class UserController < ApplicationController
 
           begin
             Notifier.email_confirm(user, user.tokens.create).deliver_now
 
           begin
             Notifier.email_confirm(user, user.tokens.create).deliver_now

-          rescue
+          rescue StandardError

             # Ignore errors sending email
           end
         else
             # Ignore errors sending email
           end
         else


@@ -758,17 +763,17 @@ class UserController < ApplicationController
   end
 
   ##
   end
 
   ##

-  # ensure that there is a "this_user" instance variable
+  # ensure that there is a "user" instance variable

   def lookup_user_by_id
   def lookup_user_by_id

-    @this_user = User.find(params[:id])
+    @user = User.find(params[:id])

   end
 
   ##
   end
 
   ##

-  # ensure that there is a "this_user" instance variable
+  # ensure that there is a "user" instance variable

   def lookup_user_by_name
   def lookup_user_by_name

-    @this_user = User.find_by(:display_name => params[:display_name])
+    @user = User.find_by(:display_name => params[:display_name])

   rescue ActiveRecord::RecordNotFound
   rescue ActiveRecord::RecordNotFound

-    redirect_to :action => "view", :display_name => params[:display_name] unless @this_user
+    redirect_to :action => "view", :display_name => params[:display_name] unless @user

   end
 
   ##
   end
 
   ##