Prevent CSRF bypass unblocking users

[rails.git] / app / views / browse / note.html.erb

diff --git a/app/views/browse/note.html.erb b/app/views/browse/note.html.erb
index 5c42fddd632730b3f65240ac3a912b5efac400a0..1a792e873952ce3dc98b5d6b7ced79e6f27cdeb2 100644 (file)
--- a/app/views/browse/note.html.erb
+++ b/app/views/browse/note.html.erb
@@ -1,83 +1,76 @@
-<table width="100%">
-  <tr>
-    <td width="100%">
-      <h2>
-        <% if @note.status == "closed" %>
-          <%= image_tag("closed_note_marker.png", :alt => 'closed') %>
-          <%= t 'browse.note.closed_title', :note_name => @note.id %>
-        <% else %>
-          <%= image_tag("open_note_marker.png", :alt => 'open') %>
-          <%= t 'browse.note.open_title', :note_name => @note.id %>
-        <% end %>
-      </h2>
-    </td>
-    <td>
-      <%= render :partial => "navigation" %>
-    </td>
-  </tr>
-  <tr valign="top">
-    <td>
-      <table>
-        <tr>
-          <th><%= t 'browse.note.created_at' %></th>
-          <td><%= l @note.created_at %></td>
-        </tr>  
-       <tr>
-         <th><%= t 'browse.note.edited_at' %></th>
-         <td><%= l @note.updated_at %></td>
-       </tr>
-       <% if @note.status == "closed" %>
-         <tr>
-           <th><%= t 'browse.note.closed_at' %></th>
-           <td><%= l @note.closed_at %></td>
-         </tr>
-       <% end %>
-       <tr>
-         <th><%= t 'browse.note.opened_by' %></th>
-         <% if @note.author.nil? %>
-           <td> <%= @note.author_name %> </td>
-         <% else %>
-           <td><%= link_to h(@note.author_name), :controller => "user", :action => "view", :display_name => @note.author_name %></td>
-         <% end %>
-       </tr>
-       <tr>
-         <th><%= t 'browse.note.description' %></th>
-         <td><%= h(@note.comments.first.body) %></td>
-       </tr>
-       <tr>
-         <th><%= t 'browse.node_details.coordinates' %></th>
-         <td><div class="geo"><%= link_to ("<span class='latitude'>#{number_with_delimiter(@note.lat)}</span>, <span class='longitude'>#{number_with_delimiter(@note.lon)}</span>"), {:controller => 'site', :action => 'index', :lat => h(@note.lat), :lon => h(@note.lon), :zoom => "18"} %></div></td>
-       </tr>
-    </table>
+<% set_title(t(".title", :id => @note.id)) %>
+
+<%= render "sidebar_header", :title => t(".#{@note.status}_title", :note_name => @note.id) %>
+
+<div class="browse-section">
+  <h4><%= t(".description") %></h4>
+  <div class="note-description">
+    <%= h(@note_comments.first.body.to_html) %>
+  </div>
+
+  <div class="details" data-coordinates="<%= @note.lat %>,<%= @note.lon %>" data-status="<%= @note.status %>">
+    <ul class="list-unstyled">
+      <li><%= note_event("opened", @note.created_at, @note.author) %></li>
+      <% if @note.status == "closed" %>
+        <li><%= note_event(@note.status, @note.closed_at, @note.all_comments.last.author) %></li>
+      <% end %>
+      <li>
+        <%= t "browse.location" %>
+        <%= link_to(t(".coordinates_html",
+                      :latitude => tag.span(number_with_delimiter(@note.lat), :class => "latitude"),
+                      :longitude => tag.span(number_with_delimiter(@note.lon), :class => "longitude")),
+                    root_path(:anchor => "map=18/#{@note.lat}/#{@note.lon}")) %>
+      </li>
+    </ul>
+  </div>
+
+  <% if @note_comments.find { |comment| comment.author.nil? } -%>
+    <p class='alert alert-warning'><%= t "javascripts.notes.show.anonymous_warning" %></p>
+  <% end -%>

 
 

-    <br />
+  <% if current_user && current_user != @note.author %>
+    <p class="text-muted"><%= report_link(t(".report"), @note) %></p>
+  <% end %>

 
 

-    <% if @note.comments.length > 1 %>
-      <table>
-        <tr>
-          <th width="20%"> <%= t 'browse.note.comment_by' %></th>
-          <th width="60%"> <%= t 'browse.note.comment' %></th>
-          <th width="20%"> <%= t 'browse.note.date' %></th> 
-        </tr>
-        <% @note.comments[1..-1].each do |comment| %>
-          <tr>
-            <td>
-              <% if comment.author.nil? %>
-                <%= comment.author_name %>
-              <% else %>
-                <%= link_to h(comment.author.display_name), :controller => "user", :action => "view", :display_name => comment.author.display_name %>                                  
-              <% end %>
-            </td>
-            <td> <%= h(comment.body) %> </td>
-            <td> <%= l comment.created_at %> </td>
-          </tr>
+  <% if @note_comments.length > 1 %>
+    <div class='note-comments'>
+      <ul class="list-unstyled">
+        <% @note_comments.drop(1).each do |comment| %>
+          <li id="c<%= comment.id %>">
+            <small class='text-muted'><%= note_event(comment.event, comment.created_at, comment.author) %></small>
+            <%= comment.body.to_html %>
+          </li>

         <% end %>
         <% end %>

-      </table>
-    <% end %>
-       
-    <hr />
-    </td>
+      </ul>
+    </div>
+  <% end %>

 
 

-    <%= render :partial => "map", :object => @note %>
-  </tr>
-</table>
+  <% if @note.status == "open" %>
+    <% if current_user -%>
+      <form action="#">
+        <div class="form-group">
+          <textarea class="form-control" name="text" cols="40" rows="5" maxlength="2000"></textarea>
+        </div>
+        <div>
+          <% if current_user.moderator? -%>
+            <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+          <% end -%>
+          <input type="submit" name="close" value="<%= t("javascripts.notes.show.resolve") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= close_note_url(@note, "json") %>">
+          <input type="submit" name="comment" value="<%= t("javascripts.notes.show.comment") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= comment_note_url(@note, "json") %>" disabled="1">
+        </div>
+      </form>
+    <% end -%>
+  <% else %>
+    <form action="#">
+      <input type="hidden" name="text" value="">
+      <div>
+        <% if current_user and current_user.moderator? -%>
+          <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+        <% end -%>
+        <% if current_user -%>
+          <input type="submit" name="reopen" value="<%= t("javascripts.notes.show.reactivate") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= reopen_note_url(@note, "json") %>">
+        <% end -%>
+      </div>
+    </form>
+  <% end %>
+</div>