protect_from_forgery
if STATUS == :database_readonly or STATUS == :database_offline
- after_filter :clear_session
- wrap_parameters false
-
- def clear_session
- session.clear
- end
-
def self.cache_sweeper(*sweepers)
end
end
require_capability(:allow_write_gpx)
end
+ ##
+ # require that the user is a moderator, or fill out a helpful error message
+ # and return them to the blocks index.
+ def require_moderator
+ unless @user.moderator?
+ if request.get?
+ flash[:error] = t('application.require_moderator.not_a_moderator')
+ redirect_to :action => 'index'
+ else
+ render :nothing => true, :status => :forbidden
+ end
+ end
+ end
+
##
# sets up the @user object for use by other methods. this is mostly called
# from the authorize method, but can be called elsewhere if authorisation
end
end
+ ##
+ # to be used as a before_filter *after* authorize. this checks that
+ # the user is a moderator and, if not, returns a forbidden error.
+ #
+ def authorize_moderator(errormessage="Access restricted to moderators")
+ # check user is a moderator
+ unless @user.moderator?
+ render :text => errormessage, :status => :forbidden
+ return false
+ end
+ end
+
def check_database_readable(need_api = false)
if STATUS == :database_offline or (need_api and STATUS == :api_offline)
redirect_to :controller => 'site', :action => 'offline'
!@user.nil?
end
+ ##
+ # ensure that there is a "this_user" instance variable
+ def lookup_this_user
+ unless @this_user = User.active.find_by_display_name(params[:display_name])
+ render_unknown_user params[:display_name]
+ end
+ end
+
##
# render a "no such user" page
def render_unknown_user(name)