protect_from_forgery
if STATUS == :database_readonly or STATUS == :database_offline
- session :off
+ after_filter :clear_session
+ wrap_parameters false
+
+ def clear_session
+ session.clear
+ end
def self.cache_sweeper(*sweepers)
end
if session[:user]
@user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first
- if @user.status == "suspended"
+ if @user.display_name != cookies["_osm_username"]
+ logger.info "Session user '#{@user.display_name}' does not match cookie user '#{cookies['_osm_username']}'"
+ reset_session
+ @user = nil
+ elsif @user.status == "suspended"
session.delete(:user)
session_expires_automatically
end
end
elsif session[:token]
- @user = User.authenticate(:token => session[:token])
- session[:user] = @user.id
+ if @user = User.authenticate(:token => session[:token])
+ session[:user] = @user.id
+ end
end
rescue Exception => ex
logger.info("Exception authorizing user: #{ex.to_s}")
+ reset_session
@user = nil
end
# is optional.
def setup_user_auth
# try and setup using OAuth
- if Authenticator.new(self, [:token]).allow?
- @user = current_token.user
- else
+ if not Authenticator.new(self, [:token]).allow?
username, passwd = get_auth_data # parse from headers
# authenticate per-scheme
if username.nil?
request.headers['X-Error-Format'].downcase == "xml"
result = OSM::API.new.get_xml_doc
result.root.name = "osmError"
- result.root << (XML::Node.new("status") << interpret_status(status))
+ result.root << (XML::Node.new("status") << "#{Rack::Utils.status_code(status)} #{Rack::Utils::HTTP_STATUS_CODES[status]}")
result.root << (XML::Node.new("message") << message)
render :text => result.to_s, :content_type => "text/xml"
end
end
- I18n.locale = request.compatible_language_from(I18n.available_locales)
+ I18n.locale = request.compatible_language_from(I18n.available_locales) || I18n.default_locale
response.headers['Content-Language'] = I18n.locale.to_s
end
##
# wrap an api call in a timeout
def api_call_timeout
- SystemTimer.timeout_after(API_TIMEOUT) do
+ OSM::Timer.timeout(API_TIMEOUT) do
yield
end
rescue Timeout::Error
##
# wrap a web page in a timeout
def web_timeout
- SystemTimer.timeout_after(WEB_TIMEOUT) do
+ OSM::Timer.timeout(WEB_TIMEOUT) do
yield
end
- rescue ActionView::TemplateError => ex
- if ex.original_exception.is_a?(Timeout::Error)
+ rescue ActionView::Template::Error => ex
+ ex = ex.original_exception
+
+ if ex.is_a?(ActiveRecord::StatementInvalid) and ex.message =~ /^Timeout::Error/
+ ex = Timeout::Error.new
+ end
+
+ if ex.is_a?(Timeout::Error)
render :action => "timeout"
else
raise
return [user, pass]
end
+ # used by oauth plugin to get the current user
+ def current_user
+ @user
+ end
+
+ # used by oauth plugin to set the current user
+ def current_user=(user)
+ @user=user
+ end
+
# override to stop oauth plugin sending errors
def invalid_oauth_response
end