Get rid of custom CSRF protection for user role changes

[rails.git] / app / controllers / way_controller.rb

diff --git a/app/controllers/way_controller.rb b/app/controllers/way_controller.rb
index cc4f1fa38d6c8279b3a1f2a39ef0e6abaa87ab81..c3ffe3c0f457f488c899c2fbd2f1bf67858e4f22 100644 (file)
--- a/app/controllers/way_controller.rb
+++ b/app/controllers/way_controller.rb
@@ -1,8 +1,9 @@
 class WayController < ApplicationController
   require 'xml/libxml'
 
-  session :off
+  skip_before_filter :verify_authenticity_token
   before_filter :authorize, :only => [:create, :update, :delete]
+  before_filter :require_allow_write_api, :only => [:create, :update, :delete]
   before_filter :require_public_data, :only => [:create, :update, :delete]
   before_filter :check_api_writable, :only => [:create, :update, :delete]
   before_filter :check_api_readable, :except => [:create, :update, :delete]
@@ -25,7 +26,7 @@ class WayController < ApplicationController
   def read
     way = Way.find(params[:id])
     
-    response.headers['Last-Modified'] = way.timestamp.rfc822
+    response.last_modified = way.timestamp
     
     if way.visible
       render :text => way.to_xml.to_s, :content_type => "text/xml"
@@ -60,18 +61,19 @@ class WayController < ApplicationController
   end
 
   def full
-    way = Way.find(params[:id])
+    way = Way.includes(:nodes => :node_tags).find(params[:id])
     
     if way.visible
-      nd_ids = way.nds + [-1]
-      nodes = Node.find(:all, :conditions => ["visible = ? AND id IN (#{nd_ids.join(',')})", true])
-      
-      # Render
+      changeset_cache = {}
+      user_display_name_cache = {}
+
       doc = OSM::API.new.get_xml_doc
-      nodes.each do |node|
-        doc.root << node.to_xml_node()
+      way.nodes.uniq.each do |node|
+        if node.visible
+          doc.root << node.to_xml_node(changeset_cache, user_display_name_cache)
+        end
       end
-      doc.root << way.to_xml_node()
+      doc.root << way.to_xml_node(nil, changeset_cache, user_display_name_cache)
       
       render :text => doc.to_s, :content_type => "text/xml"
     else
@@ -104,9 +106,7 @@ class WayController < ApplicationController
   # :id parameter. note that this used to return deleted ways as well, but
   # this seemed not to be the expected behaviour, so it was removed.
   def ways_for_node
-    wayids = WayNode.find(:all, 
-                          :conditions => ['node_id = ?', params[:id]]
-                          ).collect { |ws| ws.id[0] }.uniq
+    wayids = WayNode.where(:node_id => params[:id]).collect { |ws| ws.id[0] }.uniq
 
     doc = OSM::API.new.get_xml_doc