def authorize_web
if session[:user]
- self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first
+ self.current_user = User.find_by(:id => session[:user], :status => %w[active confirmed suspended])
if session[:fingerprint] &&
session[:fingerprint] != current_user.fingerprint
response.headers["Content-Language"] = I18n.locale.to_s
end
- def api_call_handle_error
- yield
- rescue ActionController::UnknownFormat
- head :not_acceptable
- rescue ActiveRecord::RecordNotFound => e
- head :not_found
- rescue LibXML::XML::Error, ArgumentError => e
- report_error e.message, :bad_request
- rescue ActiveRecord::RecordInvalid => e
- message = "#{e.record.class} #{e.record.id}: "
- e.record.errors.each { |error| message << "#{error.attribute}: #{error.message} (#{e.record[error.attribute].inspect})" }
- report_error message, :bad_request
- rescue OSM::APIError => e
- report_error e.message, e.status
- rescue AbstractController::ActionNotFound => e
- raise
- rescue StandardError => e
- logger.info("API threw unexpected #{e.class} exception: #{e.message}")
- e.backtrace.each { |l| logger.info(l) }
- report_error "#{e.class}: #{e.message}", :internal_server_error
- end
-
- ##
- # asserts that the request method is the +method+ given as a parameter
- # or raises a suitable error. +method+ should be a symbol, e.g: :put or :get.
- def assert_method(method)
- ok = request.send(:"#{method.to_s.downcase}?")
- raise OSM::APIBadMethodError, method unless ok
- end
-
- ##
- # wrap an api call in a timeout
- def api_call_timeout(&block)
- Timeout.timeout(Settings.api_timeout, Timeout::Error, &block)
- rescue Timeout::Error
- raise OSM::APITimeoutError
- end
-
##
# wrap a web page in a timeout
def web_timeout(&block)
- Timeout.timeout(Settings.web_timeout, Timeout::Error, &block)
+ Timeout.timeout(Settings.web_timeout, &block)
rescue ActionView::Template::Error => e
e = e.cause
if e.is_a?(Timeout::Error) ||
(e.is_a?(ActiveRecord::StatementInvalid) && e.message.include?("execution expired"))
+ ActiveRecord::Base.connection.raw_connection.cancel
render :action => "timeout"
else
raise
end
rescue Timeout::Error
+ ActiveRecord::Base.connection.raw_connection.cancel
render :action => "timeout"
end
- ##
- # ensure that there is a "user" instance variable
- def lookup_user
- render_unknown_user params[:display_name] unless @user = User.active.find_by(:display_name => params[:display_name])
- end
-
- ##
- # render a "no such user" page
- def render_unknown_user(name)
- @title = t "users.no_such_user.title"
- @not_found_user = name
-
- respond_to do |format|
- format.html { render :template => "users/no_such_user", :status => :not_found }
- format.all { head :not_found }
- end
- end
-
##
# Unfortunately if a PUT or POST request that has a body fails to
# read it then Apache will sometimes fail to return the response it
append_content_security_policy_directives(
:child_src => %w[http://127.0.0.1:8111 https://127.0.0.1:8112],
:frame_src => %w[http://127.0.0.1:8111 https://127.0.0.1:8112],
- :connect_src => [Settings.nominatim_url, Settings.overpass_url, Settings.fossgis_osrm_url, Settings.graphhopper_url],
+ :connect_src => [Settings.nominatim_url, Settings.overpass_url, Settings.fossgis_osrm_url, Settings.graphhopper_url, Settings.fossgis_valhalla_url],
:form_action => %w[render.openstreetmap.org],
:style_src => %w['unsafe-inline']
)