Prevent CSRF bypass unblocking users

[rails.git] / app / models / node.rb

diff --git a/app/models/node.rb b/app/models/node.rb
index 7a103efa5c3954ce7a4020a653627743587f56f1..a5346e87f39b71f297b9b6b4948d01f271d2618e 100644 (file)
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -1,216 +1,275 @@
-class Node < GeoRecord
-  require 'xml/libxml'
-
-  set_table_name 'current_nodes'
-  
-  validates_presence_of :user_id, :timestamp
-  validates_inclusion_of :visible, :in => [ true, false ]
-  validates_numericality_of :latitude, :longitude
-  validate :validate_position
+# == Schema Information
+#
+# Table name: current_nodes
+#
+#  id           :bigint(8)        not null, primary key
+#  latitude     :integer          not null
+#  longitude    :integer          not null
+#  changeset_id :bigint(8)        not null
+#  visible      :boolean          not null
+#  timestamp    :datetime         not null
+#  tile         :bigint(8)        not null
+#  version      :bigint(8)        not null
+#
+# Indexes
+#
+#  current_nodes_tile_idx       (tile)
+#  current_nodes_timestamp_idx  (timestamp)
+#
+# Foreign Keys
+#
+#  current_nodes_changeset_id_fkey  (changeset_id => changesets.id)
+#
+
+class Node < ApplicationRecord
+  require "xml/libxml"
+
+  include GeoRecord
+  include ConsistencyValidations
+  include NotRedactable
+  include ObjectMetadata
+
+  self.table_name = "current_nodes"
+
+  belongs_to :changeset
+
+  has_many :old_nodes, -> { order(:version) }

 
 

-  has_many :old_nodes, :foreign_key => :id

   has_many :way_nodes
   has_many :way_nodes

-  has_many :node_tags, :foreign_key => :id
-  belongs_to :user
- 
-  def validate_position
-    errors.add_to_base("Node is not in the world") unless in_world?
-  end
+  has_many :ways, :through => :way_nodes
+
+  has_many :node_tags
+
+  has_many :old_way_nodes
+  has_many :ways_via_history, :class_name => "Way", :through => :old_way_nodes, :source => :way
+
+  has_many :containing_relation_members, :class_name => "RelationMember", :as => :member
+  has_many :containing_relations, :class_name => "Relation", :through => :containing_relation_members, :source => :relation
+
+  validates :id, :uniqueness => true, :presence => { :on => :update },
+                 :numericality => { :on => :update, :only_integer => true }
+  validates :version, :presence => true,
+                      :numericality => { :only_integer => true }
+  validates :changeset_id, :presence => true,
+                           :numericality => { :only_integer => true }
+  validates :latitude, :presence => true,
+                       :numericality => { :only_integer => true }
+  validates :longitude, :presence => true,
+                        :numericality => { :only_integer => true }
+  validates :timestamp, :presence => true
+  validates :changeset, :associated => true
+  validates :visible, :inclusion => [true, false]

 
 

-  def in_world?
-    return false if self.lat < -90 or self.lat > 90
-    return false if self.lon < -180 or self.lon > 180
-    return true
-  end
+  validate :validate_position

 
 

-  #
-  # Search for nodes matching tags within bounding_box
-  #
-  # Also adheres to limitations such as within max_number_of_nodes
-  #
-  def self.search(bounding_box, tags = {})
-    min_lon, min_lat, max_lon, max_lat = *bounding_box
-    # @fixme a bit of a hack to search for only visible nodes
-    # couldn't think of another to add to tags condition
-    #conditions_hash = tags.merge({ 'visible' => 1 })
-  
-    # using named placeholders http://www.robbyonrails.com/articles/2005/10/21/using-named-placeholders-in-ruby
-    #keys = []
-    #values = {}
-
-    #conditions_hash.each do |key,value|
-    #  keys <<  "#{key} = :#{key}"
-    #  values[key.to_sym] = value
-    #end 
-    #conditions = keys.join(' AND ')
- 
-    find_by_area(min_lat, min_lon, max_lat, max_lon,
-                    :conditions => 'visible = 1',
-                    :limit => APP_CONFIG['max_number_of_nodes']+1)  
+  scope :visible, -> { where(:visible => true) }
+  scope :invisible, -> { where(:visible => false) }
+
+  # Sanity check the latitude and longitude and add an error if it's broken
+  def validate_position
+    errors.add(:base, "Node is not in the world") unless in_world?

   end
 
   # Read in xml as text and return it's Node object representation
   end
 
   # Read in xml as text and return it's Node object representation

-  def self.from_xml(xml, create=false)
-    begin
-      p = XML::Parser.new
-      p.string = xml
-      doc = p.parse
-
-      doc.find('//osm/node').each do |pt|
-       return Node.from_xml_node(pt, create)
-      end
-    rescue
-      return nil
+  def self.from_xml(xml, create: false)
+    p = XML::Parser.string(xml, :options => XML::Parser::Options::NOERROR)
+    doc = p.parse
+    pt = doc.find_first("//osm/node")
+
+    if pt
+      Node.from_xml_node(pt, :create => create)
+    else
+      raise OSM::APIBadXMLError.new("node", xml, "XML doesn't contain an osm/node element.")

     end
     end

+  rescue LibXML::XML::Error, ArgumentError => e
+    raise OSM::APIBadXMLError.new("node", xml, e.message)

   end
 
   end
 

-  def self.from_xml_node(pt, create=false)
+  def self.from_xml_node(pt, create: false)

     node = Node.new
 
     node = Node.new
 

-    node.lat = pt['lat'].to_f
-    node.lon = pt['lon'].to_f
+    raise OSM::APIBadXMLError.new("node", pt, "lat missing") if pt["lat"].nil?
+    raise OSM::APIBadXMLError.new("node", pt, "lon missing") if pt["lon"].nil?
+
+    node.lat = OSM.parse_float(pt["lat"], OSM::APIBadXMLError, "node", pt, "lat not a number")
+    node.lon = OSM.parse_float(pt["lon"], OSM::APIBadXMLError, "node", pt, "lon not a number")
+    raise OSM::APIBadXMLError.new("node", pt, "Changeset id is missing") if pt["changeset"].nil?
+
+    node.changeset_id = pt["changeset"].to_i
+
+    raise OSM::APIBadUserInput, "The node is outside this world" unless node.in_world?
+
+    # version must be present unless creating
+    raise OSM::APIBadXMLError.new("node", pt, "Version is required when updating") unless create || !pt["version"].nil?

 
 

-    return nil unless node.in_world?
+    node.version = create ? 0 : pt["version"].to_i

 
     unless create
 
     unless create

-      if pt['id'] != '0'
-       node.id = pt['id'].to_i
-      end
+      raise OSM::APIBadXMLError.new("node", pt, "ID is required when updating.") if pt["id"].nil?
+
+      node.id = pt["id"].to_i
+      # .to_i will return 0 if there is no number that can be parsed.
+      # We want to make sure that there is no id with zero anyway
+      raise OSM::APIBadUserInput, "ID of node cannot be zero when updating." if node.id.zero?

     end
 
     end
 

-    node.visible = pt['visible'] and pt['visible'] == 'true'
+    # We don't care about the time, as it is explicitly set on create/update/delete
+    # We don't care about the visibility as it is implicit based on the action
+    # and set manually before the actual delete
+    node.visible = true

 
 

-    if create
-      node.timestamp = Time.now
-    else
-      if pt['timestamp']
-       node.timestamp = Time.parse(pt['timestamp'])
-      end
-    end
+    # Start with no tags
+    node.tags = {}

 
 

-    tags = []
+    # Add in any tags from the XML
+    pt.find("tag").each do |tag|
+      raise OSM::APIBadXMLError.new("node", pt, "tag is missing key") if tag["k"].nil?
+      raise OSM::APIBadXMLError.new("node", pt, "tag is missing value") if tag["v"].nil?

 
 

-    pt.find('tag').each do |tag|
-      node.add_tag_key_val(tag['k'],tag['v'])
+      node.add_tag_key_val(tag["k"], tag["v"])

     end
 
     end
 

-    return node
+    node

   end
 
   end
 

-  def save_with_history!
-    t = Time.now
+  ##
+  # the bounding box around a node, which is used for determining the changeset's
+  # bounding box
+  def bbox
+    BoundingBox.new(longitude, latitude, longitude, latitude)
+  end
+
+  # Should probably be renamed delete_from to come in line with update
+  def delete_with_history!(new_node, user)
+    raise OSM::APIAlreadyDeletedError.new("node", new_node.id) unless visible
+
+    # need to start the transaction here, so that the database can
+    # provide repeatable reads for the used-by checks. this means it
+    # shouldn't be possible to get race conditions.

     Node.transaction do
     Node.transaction do

-      self.version += 1
-      self.timestamp = t
-      self.save!
+      lock!
+      check_consistency(self, new_node, user)
+      ways = Way.joins(:way_nodes).where(:visible => true, :current_way_nodes => { :node_id => id }).order(:id)
+      raise OSM::APIPreconditionFailedError, "Node #{id} is still used by ways #{ways.collect(&:id).join(',')}." unless ways.empty?

 
 

-      # Create a NodeTag
-      tags = self.tags
-      NodeTag.delete_all(['id = ?', self.id])
-      tags.each do |k,v|
-       tag = NodeTag.new
-       tag.k = k 
-       tag.v = v 
-       tag.id = self.id
-       tag.save!
-      end 
+      rels = Relation.joins(:relation_members).where(:visible => true, :current_relation_members => { :member_type => "Node", :member_id => id }).order(:id)
+      raise OSM::APIPreconditionFailedError, "Node #{id} is still used by relations #{rels.collect(&:id).join(',')}." unless rels.empty?

 
 

-      # Create an OldNode
-      old_node = OldNode.from_node(self)
-      old_node.timestamp = t
-      old_node.save_with_dependencies!
-    end
-  end
+      self.changeset_id = new_node.changeset_id
+      self.tags = {}
+      self.visible = false

 
 

-  def delete_with_history(user)
-    if self.visible
-      if WayNode.find(:first, :joins => "INNER JOIN current_ways ON current_ways.id = current_way_nodes.id", :conditions => [ "current_ways.visible = 1 AND current_way_nodes.node_id = ?", self.id ])
-       raise OSM::APIPreconditionFailedError.new
-      elsif RelationMember.find(:first, :joins => "INNER JOIN current_relations ON current_relations.id=current_relation_members.id", :conditions => [ "visible = 1 AND member_type='node' and member_id=?", self.id])
-       raise OSM::APIPreconditionFailedError.new
-      else
-       self.user_id = user.id
-       self.visible = 0
-       save_with_history!
-      end
-    else
-      raise OSM::APIAlreadyDeletedError.new
+      # update the changeset with the deleted position
+      changeset.update_bbox!(bbox)
+
+      save_with_history!

     end
   end
 
   def update_from(new_node, user)
     end
   end
 
   def update_from(new_node, user)

-    self.user_id = user.id
-    self.latitude = new_node.latitude 
-    self.longitude = new_node.longitude
-    self.tags = new_node.tags
-    self.visible = true
-    save_with_history!
-  end
+    Node.transaction do
+      lock!
+      check_consistency(self, new_node, user)

 
 

-  def to_xml
-    doc = OSM::API.new.get_xml_doc
-    doc.root << to_xml_node()
-    return doc
-  end
+      # update changeset first
+      self.changeset_id = new_node.changeset_id
+      self.changeset = new_node.changeset

 
 

-  def to_xml_node(user_display_name_cache = nil)
-    el1 = XML::Node.new 'node'
-    el1['id'] = self.id.to_s
-    el1['lat'] = self.lat.to_s
-    el1['lon'] = self.lon.to_s
+      # update changeset bbox with *old* position first
+      changeset.update_bbox!(bbox)

 
 

-    user_display_name_cache = {} if user_display_name_cache.nil?
+      # FIXME: logic needs to be double checked
+      self.latitude = new_node.latitude
+      self.longitude = new_node.longitude
+      self.tags = new_node.tags
+      self.visible = true

 
 

-    if user_display_name_cache and user_display_name_cache.key?(self.user_id)
-      # use the cache if available
-    elsif self.user.data_public?
-      user_display_name_cache[self.user_id] = self.user.display_name
-    else
-      user_display_name_cache[self.user_id] = nil
+      # update changeset bbox with *new* position
+      changeset.update_bbox!(bbox)
+
+      save_with_history!

     end
     end

+  end

 
 

-    el1['user'] = user_display_name_cache[self.user_id] unless user_display_name_cache[self.user_id].nil?
+  def create_with_history(user)
+    check_create_consistency(self, user)
+    self.version = 0
+    self.visible = true

 
 

-    self.tags.each do |k,v|
-      el2 = XML::Node.new('tag')
-      el2['k'] = k.to_s
-      el2['v'] = v.to_s
-      el1 << el2
-    end
+    # update the changeset to include the new location
+    changeset.update_bbox!(bbox)

 
 

-    el1['visible'] = self.visible.to_s
-    el1['timestamp'] = self.timestamp.xmlschema
-    el1['version'] = self.version.to_s
-    return el1
+    save_with_history!

   end
 
   def tags_as_hash
   end
 
   def tags_as_hash

-    hash = {}
-    Tags.split(self.tags) do |k,v|
-      hash[k] = v
-    end
-    hash
+    tags

   end
 
   def tags
   end
 
   def tags

-    unless @tags
-      @tags = {}
-      self.node_tags.each do |tag|
-        @tags[tag.k] = tag.v
-      end
-    end
-    @tags
+    @tags ||= Hash[node_tags.collect { |t| [t.k, t.v] }]

   end
 
   end
 

-  def tags=(t)
-    @tags = t 
-  end 
+  attr_writer :tags
+
+  def add_tag_key_val(k, v)
+    @tags ||= {}
+
+    # duplicate tags are now forbidden, so we can't allow values
+    # in the hash to be overwritten.
+    raise OSM::APIDuplicateTagsError.new("node", id, k) if @tags.include? k

 
 

-  def add_tag_key_val(k,v)
-    @tags = Hash.new unless @tags

     @tags[k] = v
   end
 
     @tags[k] = v
   end
 

+  ##
+  # are the preconditions OK? this is mainly here to keep the duck
+  # typing interface the same between nodes, ways and relations.
+  def preconditions_ok?
+    in_world?
+  end
+
+  ##
+  # dummy method to make the interfaces of node, way and relation
+  # more consistent.
+  def fix_placeholders!(_id_map, _placeholder_id = nil)
+    # nodes don't refer to anything, so there is nothing to do here
+  end

 
 

+  private

 
 

+  def save_with_history!
+    t = Time.now.getutc
+
+    self.version += 1
+    self.timestamp = t
+
+    Node.transaction do
+      # clone the object before saving it so that the original is
+      # still marked as dirty if we retry the transaction
+      clone.save!
+
+      # Create a NodeTag
+      tags = self.tags
+      NodeTag.where(:node_id => id).delete_all
+      tags.each do |k, v|
+        tag = NodeTag.new
+        tag.node_id = id
+        tag.k = k
+        tag.v = v
+        tag.save!
+      end
+
+      # Create an OldNode
+      old_node = OldNode.from_node(self)
+      old_node.timestamp = t
+      old_node.save_with_dependencies!
+
+      # tell the changeset we updated one element only
+      changeset.add_changes! 1
+
+      # save the changeset in case of bounding box updates
+      changeset.save!
+    end
+  end

 end
 end