-# Filters added to this controller will be run for all controllers in the application.
-# Likewise, all the methods added will be available for all controllers.
class ApplicationController < ActionController::Base
+ protect_from_forgery
+
if STATUS == :database_readonly or STATUS == :database_offline
session :off
+
+ def self.cache_sweeper(*sweepers)
+ end
end
def authorize_web
@user = User.find(session[:user], :conditions => {:status => ["active", "confirmed", "suspended"]})
if @user.status == "suspended"
- session[:user] = nil
+ session.delete(:user)
session_expires_automatically
redirect_to :controller => "user", :action => "suspended"
# don't allow access to any auth-requiring part of the site unless
# the new CTs have been seen (and accept/decline chosen).
- elsif !@user.terms_seen and flash[:showing_terms].nil?
+ elsif !@user.terms_seen and flash[:skip_terms].nil?
flash[:notice] = t 'user.terms.you need to accept or decline'
if params[:referer]
redirect_to :controller => "user", :action => "terms", :referer => params[:referer]
else
- redirect_to :controller => "user", :action => "terms", :referer => request.request_uri
+ redirect_to :controller => "user", :action => "terms", :referer => request.fullpath
end
end
elsif session[:token]
end
def require_user
- redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri unless @user
+ redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath unless @user
end
##
# method, otherwise an OAuth token was used, which has to be checked.
unless current_token.nil?
unless current_token.read_attribute(cap)
- render :text => "OAuth token doesn't have that capability.", :status => :forbidden
+ report_error "OAuth token doesn't have that capability.", :forbidden
return false
end
end
def require_cookies
if request.cookies["_osm_session"].to_s == ""
if params[:cookie_test].nil?
+ session[:cookie_test] = true
redirect_to params.merge(:cookie_test => "true")
return false
else
flash.now[:warning] = t 'application.require_cookies.cookies_needed'
end
+ else
+ session.delete(:cookie_test)
end
end
end
def require_allow_write_api
require_capability(:allow_write_api)
+
+ if REQUIRE_TERMS_AGREED and @user.terms_agreed.nil?
+ report_error "You must accept the contributor terms before you can edit.", :forbidden
+ return false
+ end
end
def require_allow_read_gpx
require_capability(:allow_read_gpx)
# if the user hasn't seen the contributor terms then don't
# allow editing - they have to go to the web site and see
# (but can decline) the CTs to continue.
- if REQUIRE_TERMS_SEEN and not @user.terms_seen
+ if REQUIRE_TERMS_SEEN and not @user.terms_seen and flash[:skip_terms].nil?
set_locale
report_error t('application.setup_user_auth.need_to_see_terms'), :forbidden
end