Close a number of holes in the API by making it validate changes

[rails.git] / app / controllers / api_controller.rb

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index bb135a01f55a7733de3fb75f22a54848844007bf..4b785f8bcf74eba6b013ac14c0e1fc67b88fcd98 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -6,15 +6,109 @@ class ApiController < ApplicationController
   helper :user
   model :user
 
   helper :user
   model :user
 

-  def authorize_web
-    @current_user = User.find_by_token(session[:token])
-  end
+  #COUNT is the number of map requests to allow before exiting and starting a new process
+  @@count = COUNT

 
   # The maximum area you're allowed to request, in square degrees
   MAX_REQUEST_AREA = 0.25
 
 
   # The maximum area you're allowed to request, in square degrees
   MAX_REQUEST_AREA = 0.25
 

+
+  # Number of GPS trace/trackpoints returned per-page
+  TRACEPOINTS_PER_PAGE = 5000
+  
+  def trackpoints
+    @@count+=1
+    response.headers["Content-Type"] = 'text/xml'
+    #retrieve the page number
+    page = params['page'].to_i
+    unless page
+        page = 0;
+    end
+
+    unless page >= 0
+        report_error("Page number must be greater than or equal to 0")
+        return
+    end
+
+    offset = page * TRACEPOINTS_PER_PAGE
+
+    # Figure out the bbox
+    bbox = params['bbox']
+    unless bbox and bbox.count(',') == 3
+      report_error("The parameter bbox is required, and must be of the form min_lon,min_lat,max_lon,max_lat")
+      return
+    end
+
+    bbox = bbox.split(',')
+
+    min_lon = bbox[0].to_f
+    min_lat = bbox[1].to_f
+    max_lon = bbox[2].to_f
+    max_lat = bbox[3].to_f
+
+    # check the bbox is sane
+    unless min_lon <= max_lon
+      report_error("The minimum longitude must be less than the maximum longitude, but it wasn't")
+      return
+    end
+    unless min_lat <= max_lat
+      report_error("The minimum latitude must be less than the maximum latitude, but it wasn't")
+      return
+    end
+    unless min_lon >= -180 && min_lat >= -90 && max_lon <= 180 && max_lat <= 90
+      report_error("The latitudes must be between -90 and 90, and longitudes between -180 and 180")
+      return
+    end
+
+    # check the bbox isn't too large
+    requested_area = (max_lat-min_lat)*(max_lon-min_lon)
+    if requested_area > MAX_REQUEST_AREA
+      report_error("The maximum bbox size is " + MAX_REQUEST_AREA.to_s + ", and your request was too large. Either request a smaller area, or use planet.osm")
+      return
+    end
+
+    # integerise
+    min_lat = min_lat * 1000000
+    max_lat = max_lat * 1000000
+    min_lon = min_lon * 1000000
+    max_lon = max_lon * 1000000
+    # get all the points
+    points = Tracepoint.find(:all, :conditions => ['gps_points.latitude > ? AND gps_points.longitude > ? AND gps_points.latitude < ? AND gps_points.longitude < ? AND ( public = 1 OR gpx_files.user_id = ? ) AND visible = 1', min_lat.to_i, min_lon.to_i, max_lat.to_i, max_lon.to_i, @user.id ], :select => "gps_points.*", :joins => "INNER JOIN gpx_files ON gpx_files.id = gpx_id", :offset => offset, :limit => TRACEPOINTS_PER_PAGE, :order => "timestamp DESC" )
+
+    doc = XML::Document.new
+    doc.encoding = 'UTF-8'
+    root = XML::Node.new 'gpx'
+    root['version'] = '1.0'
+    root['creator'] = 'OpenStreetMap.org'
+    root['xmlns'] = "http://www.topografix.com/GPX/1/0/"
+    
+    doc.root = root
+
+    track = XML::Node.new 'trk'
+    doc.root << track
+
+    trkseg = XML::Node.new 'trkseg'
+    track << trkseg
+
+    points.each do |point|
+      trkseg << point.to_xml_node()
+    end
+
+    #exit when we have too many requests
+    if @@count > MAX_COUNT
+      render :text => doc.to_s
+      @@count = COUNT
+      exit!
+    end
+
+    render :text => doc.to_s
+
+  end
+

   def map
     GC.start
   def map
     GC.start

+    @@count+=1
+

     response.headers["Content-Type"] = 'text/xml'
     # Figure out the bbox
     bbox = params['bbox']
     response.headers["Content-Type"] = 'text/xml'
     # Figure out the bbox
     bbox = params['bbox']


@@ -60,6 +154,11 @@ class ApiController < ApplicationController
       report_error("You requested too many nodes (limit is 50,000). Either request a smaller area, or use planet.osm")
     end
 
       report_error("You requested too many nodes (limit is 50,000). Either request a smaller area, or use planet.osm")
     end
 

+    if node_ids.length == 0
+      render :text => "<osm version='0.4'></osm>"
+      return
+    end
+

     # grab the segments
     segments = Array.new
     if node_ids.length > 0
     # grab the segments
     segments = Array.new
     if node_ids.length > 0


@@ -96,9 +195,12 @@ class ApiController < ApplicationController
 
       list_of_way_segments = list_of_way_segs.collect { |way_seg| way_seg.segment_id }
 
 
       list_of_way_segments = list_of_way_segs.collect { |way_seg| way_seg.segment_id }
 

+       else
+         list_of_way_segments = Array.new

     end
 
     end
 

-    segments_to_fetch = list_of_way_segments.uniq - segment_ids
+    # - [0] in case some thing links to segment 0 which doesn't exist. Shouldn't actually ever happen but it does. FIXME: file a ticket for this
+    segments_to_fetch = (list_of_way_segments.uniq - segment_ids) - [0]

 
     if segments_to_fetch.length > 0
       segments += Segment.find(segments_to_fetch)
 
     if segments_to_fetch.length > 0
       segments += Segment.find(segments_to_fetch)


@@ -139,6 +241,13 @@ class ApiController < ApplicationController
     end 
 
     render :text => doc.to_s
     end 
 
     render :text => doc.to_s

+    
+    #exit when we have too many requests
+    if @@count > MAX_COUNT
+      @@count = COUNT
+      
+      exit!
+    end

 
   end
 end
 
   end
 end