Attempt to avoid polynomial time matches on user supplied data

[rails.git] / app / controllers / api / user_preferences_controller.rb

diff --git a/app/controllers/api/user_preferences_controller.rb b/app/controllers/api/user_preferences_controller.rb
index 82f6c6a4d78255d6fdc8b17087888679f54ed4f6..02a23095addd70ef9a72dde3d84cad35a257b308 100644 (file)
--- a/app/controllers/api/user_preferences_controller.rb
+++ b/app/controllers/api/user_preferences_controller.rb
@@ -1,43 +1,36 @@
-# Update and read user preferences, which are arbitrayr key/val pairs
+# Update and read user preferences, which are arbitrary key/val pairs
 module Api
-  class UserPreferencesController < ApplicationController
-    skip_before_action :verify_authenticity_token
+  class UserPreferencesController < ApiController
     before_action :authorize
 
     authorize_resource
 
     around_action :api_call_handle_error
 
-    ##
-    # return all the preferences as an XML document
-    def read
-      doc = OSM::API.new.get_xml_doc
-
-      prefs = current_user.preferences
+    before_action :set_request_formats
 
-      el1 = XML::Node.new "preferences"
+    ##
+    # return all the preferences
+    def index
+      @user_preferences = current_user.preferences
 
-      prefs.each do |pref|
-        el1 << pref.to_xml_node
+      respond_to do |format|
+        format.xml
+        format.json
       end
-
-      doc.root << el1
-      render :xml => doc.to_s
     end
 
     ##
     # return the value for a single preference
-    def read_one
+    def show
       pref = UserPreference.find([current_user.id, params[:preference_key]])
 
       render :plain => pref.v.to_s
     end
 
     # update the entire set of preferences
-    def update
-      old_preferences = current_user.preferences.each_with_object({}) do |preference, preferences|
-        preferences[preference.k] = preference
-      end
+    def update_all
+      old_preferences = current_user.preferences.index_by(&:k)
 
       new_preferences = {}
 
@@ -64,7 +57,7 @@ module Api
 
     ##
     # update the value of a single preference
-    def update_one
+    def update
       begin
         pref = UserPreference.find([current_user.id, params[:preference_key]])
       rescue ActiveRecord::RecordNotFound
@@ -81,7 +74,7 @@ module Api
 
     ##
     # delete a single preference
-    def delete_one
+    def destroy
       UserPreference.find([current_user.id, params[:preference_key]]).delete
 
       render :plain => ""