Implement the cancan filters for diary entries

[rails.git] / app / controllers / user_controller.rb

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index 0c3ad0b05e31444fee19e1aa82318525da740b34..d853d4822979b6ab956a166cd6946c12f5f7e752 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -1,6 +1,8 @@
 class UserController < ApplicationController
   layout "site", :except => [:api_details]
 
+  skip_authorization_check :only => [:login, :logout]
+
   skip_before_action :verify_authenticity_token, :only => [:api_read, :api_details, :api_gpx_files, :auth_success]
   before_action :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details]
   before_action :authorize, :only => [:api_details, :api_gpx_files]
@@ -118,7 +120,6 @@ class UserController < ApplicationController
   end
 
   def account
-    @title = t "user.account.title"
     @tokens = current_user.oauth_tokens.authorized
 
     if params[:user] && params[:user][:display_name] && params[:user][:description]
@@ -135,6 +136,7 @@ class UserController < ApplicationController
         current_user.errors.add(attribute, error)
       end
     end
+    @title = t "user.account.title"
   end
 
   def go_public
@@ -377,7 +379,7 @@ class UserController < ApplicationController
   end
 
   def api_read
-    if @this_user.visible?
+    if @user.visible?
       render :action => :api_read, :content_type => "text/xml"
     else
       head :gone
@@ -385,7 +387,7 @@ class UserController < ApplicationController
   end
 
   def api_details
-    @this_user = current_user
+    @user = current_user
     render :action => :api_read, :content_type => "text/xml"
   end
 
@@ -398,11 +400,11 @@ class UserController < ApplicationController
   end
 
   def view
-    @this_user = User.find_by(:display_name => params[:display_name])
+    @user = User.find_by(:display_name => params[:display_name])
 
-    if @this_user &&
-       (@this_user.visible? || (current_user && current_user.administrator?))
-      @title = @this_user.display_name
+    if @user &&
+       (@user.visible? || (current_user && current_user.administrator?))
+      @title = @user.display_name
     else
       render_unknown_user params[:display_name]
     end
@@ -462,15 +464,15 @@ class UserController < ApplicationController
   ##
   # sets a user's status
   def set_status
-    @this_user.status = params[:status]
-    @this_user.save
+    @user.status = params[:status]
+    @user.save
     redirect_to :action => "view", :display_name => params[:display_name]
   end
 
   ##
   # delete a user, marking them as deleted and removing personal data
   def delete
-    @this_user.delete
+    @user.delete
     redirect_to :action => "view", :display_name => params[:display_name]
   end
 
@@ -712,7 +714,7 @@ class UserController < ApplicationController
     end
 
     if user.save
-      set_locale
+      set_locale(true)
 
       if user.new_email.blank? || user.new_email == user.email
         flash.now[:notice] = t "user.account.flash update success"
@@ -761,17 +763,17 @@ class UserController < ApplicationController
   end
 
   ##
-  # ensure that there is a "this_user" instance variable
+  # ensure that there is a "user" instance variable
   def lookup_user_by_id
-    @this_user = User.find(params[:id])
+    @user = User.find(params[:id])
   end
 
   ##
-  # ensure that there is a "this_user" instance variable
+  # ensure that there is a "user" instance variable
   def lookup_user_by_name
-    @this_user = User.find_by(:display_name => params[:display_name])
+    @user = User.find_by(:display_name => params[:display_name])
   rescue ActiveRecord::RecordNotFound
-    redirect_to :action => "view", :display_name => params[:display_name] unless @this_user
+    redirect_to :action => "view", :display_name => params[:display_name] unless @user
   end
 
   ##