Enforce rate limit for API calls which make changes

[rails.git] / app / controllers / application_controller.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 87be14e5b3559eb56c2d435bb398f7f4f69dc0e8..c830d4bcd37bbce3177e80dd295cb4067bae8299 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -22,7 +22,7 @@ class ApplicationController < ActionController::Base
 
   def authorize_web
     if session[:user]
-      self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first
+      self.current_user = User.find_by(:id => session[:user], :status => %w[active confirmed suspended])
 
       if session[:fingerprint] &&
          session[:fingerprint] != current_user.fingerprint
@@ -196,45 +196,6 @@ class ApplicationController < ActionController::Base
     response.headers["Content-Language"] = I18n.locale.to_s
   end
 
-  def api_call_handle_error
-    yield
-  rescue ActionController::UnknownFormat
-    head :not_acceptable
-  rescue ActiveRecord::RecordNotFound => e
-    head :not_found
-  rescue LibXML::XML::Error, ArgumentError => e
-    report_error e.message, :bad_request
-  rescue ActiveRecord::RecordInvalid => e
-    message = "#{e.record.class} #{e.record.id}: "
-    e.record.errors.each { |error| message << "#{error.attribute}: #{error.message} (#{e.record[error.attribute].inspect})" }
-    report_error message, :bad_request
-  rescue OSM::APIError => e
-    report_error e.message, e.status
-  rescue AbstractController::ActionNotFound => e
-    raise
-  rescue StandardError => e
-    logger.info("API threw unexpected #{e.class} exception: #{e.message}")
-    e.backtrace.each { |l| logger.info(l) }
-    report_error "#{e.class}: #{e.message}", :internal_server_error
-  end
-
-  ##
-  # asserts that the request method is the +method+ given as a parameter
-  # or raises a suitable error. +method+ should be a symbol, e.g: :put or :get.
-  def assert_method(method)
-    ok = request.send(:"#{method.to_s.downcase}?")
-    raise OSM::APIBadMethodError, method unless ok
-  end
-
-  ##
-  # wrap an api call in a timeout
-  def api_call_timeout(&block)
-    Timeout.timeout(Settings.api_timeout, Timeout::Error, &block)
-  rescue Timeout::Error
-    ActiveRecord::Base.connection.raw_connection.cancel
-    raise OSM::APITimeoutError
-  end
-
   ##
   # wrap a web page in a timeout
   def web_timeout(&block)
@@ -254,24 +215,6 @@ class ApplicationController < ActionController::Base
     render :action => "timeout"
   end
 
-  ##
-  # ensure that there is a "user" instance variable
-  def lookup_user
-    render_unknown_user params[:display_name] unless @user = User.active.find_by(:display_name => params[:display_name])
-  end
-
-  ##
-  # render a "no such user" page
-  def render_unknown_user(name)
-    @title = t "users.no_such_user.title"
-    @not_found_user = name
-
-    respond_to do |format|
-      format.html { render :template => "users/no_such_user", :status => :not_found }
-      format.all { head :not_found }
-    end
-  end
-
   ##
   # Unfortunately if a PUT or POST request that has a body fails to
   # read it then Apache will sometimes fail to return the response it