protect_from_forgery :with => :exception
+ add_flash_types :warning, :error
+
rescue_from CanCan::AccessDenied, :with => :deny_access
check_authorization
around_action :better_errors_allow_inline, :if => proc { Rails.env.development? }
attr_accessor :current_user
+ attr_accessor :oauth_token
helper_method :current_user
+ helper_method :oauth_token
+ helper_method :preferred_langauges
private
end
def require_oauth
- @oauth = current_user.access_token(Settings.oauth_key) if current_user && Settings.key?(:oauth_key)
+ @oauth_token = current_user.access_token(Settings.oauth_key) if current_user && Settings.key?(:oauth_key)
end
##
if request.cookies["_osm_session"].to_s == ""
if params[:cookie_test].nil?
session[:cookie_test] = true
- redirect_to params.to_unsafe_h.merge(:cookie_test => "true")
+ redirect_to params.to_unsafe_h.merge(:only_path => true, :cookie_test => "true")
false
else
flash.now[:warning] = t "application.require_cookies.cookies_needed"
e = e.cause
if e.is_a?(Timeout::Error) ||
- (e.is_a?(ActiveRecord::StatementInvalid) && e.message =~ /execution expired/)
+ (e.is_a?(ActiveRecord::StatementInvalid) && e.message.include?("execution expired"))
render :action => "timeout"
else
raise
# override to stop oauth plugin sending errors
def invalid_oauth_response; end
+
+ # clean any referer parameter
+ def safe_referer(referer)
+ referer = URI.parse(referer)
+
+ if referer.scheme == "http" || referer.scheme == "https"
+ referer.scheme = nil
+ referer.host = nil
+ referer.port = nil
+ elsif referer.scheme || referer.host || referer.port
+ referer = nil
+ end
+
+ referer.to_s
+ end
end