Avoid mass assignment error in spam observer

[rails.git] / lib / consistency_validations.rb

diff --git a/lib/consistency_validations.rb b/lib/consistency_validations.rb
index 46fb3c06e2ad771a9fd00db2ab618d4e0c453b80..d23ef8400ee4ab1df6fc2c19f3db0a724795eb52 100644 (file)
--- a/lib/consistency_validations.rb
+++ b/lib/consistency_validations.rb
@@ -6,7 +6,9 @@ module ConsistencyValidations
   # needed for creates, but are currently not run :-( 
   # This will throw an exception if there is an inconsistency
   def check_consistency(old, new, user)
   # needed for creates, but are currently not run :-( 
   # This will throw an exception if there is an inconsistency
   def check_consistency(old, new, user)

-    if new.version != old.version
+    if new.id != old.id or new.id.nil? or old.id.nil?
+      raise OSM::APIPreconditionFailedError.new("New and old IDs don't match on #{new.class.to_s}. #{new.id} != #{old.id}.")
+    elsif new.version != old.version

       raise OSM::APIVersionMismatchError.new(new.id, new.class.to_s, new.version, old.version)
     elsif new.changeset.nil?
       raise OSM::APIChangesetMissingError.new
       raise OSM::APIVersionMismatchError.new(new.id, new.class.to_s, new.version, old.version)
     elsif new.changeset.nil?
       raise OSM::APIChangesetMissingError.new


@@ -27,4 +29,19 @@ module ConsistencyValidations
       raise OSM::APIChangesetAlreadyClosedError.new(new.changeset)
     end
   end
       raise OSM::APIChangesetAlreadyClosedError.new(new.changeset)
     end
   end

+
+  ##
+  # subset of consistency checks which should be applied to almost
+  # all the changeset controller's writable methods.
+  def check_changeset_consistency(changeset, user)
+    # check user credentials - only the user who opened a changeset
+    # may alter it.
+    if changeset.nil?
+      raise OSM::APIChangesetMissingError.new
+    elsif user.id != changeset.user_id 
+      raise OSM::APIUserChangesetMismatchError.new
+    elsif not changeset.is_open?
+      raise OSM::APIChangesetAlreadyClosedError.new(changeset)
+    end
+  end

 end
 end