Sanitize user descriptions properly.

[rails.git] / app / controllers / api_controller.rb

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index c17ff679854075f34760a13bfea6cf7971f1fecb..9cf8977d332de0bfbf246ca126308cc1192160e2 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -79,8 +79,9 @@ class ApiController < ApplicationController
       exit!
     end
 
-    render :text => doc.to_s, :content_type => "text/xml"
+    response.headers["Content-Disposition"] = "attachment; filename=\"map.osm\""
 
+    render :text => doc.to_s, :content_type => "text/xml"
   end
 
   def map
@@ -123,8 +124,6 @@ class ApiController < ApplicationController
       return
     end
 
-    relations = Array.new
-
     doc = OSM::API.new.get_xml_doc
 
     # get ways
@@ -169,31 +168,15 @@ class ApiController < ApplicationController
       end
     end 
 
-    # collect relationships. currently done in one big block at the end;
-    # may need to move this upwards if people want automatic completion of
-    # relationships, i.e. deliver referenced objects like we do with ways...
-    relations = Array.new
-    if visible_nodes.length > 0
-        relations += Relation.find_by_sql("select e.* from current_relations e,current_relation_members em where " +
-            "e.visible=1 and " +
-            "em.id = e.id and em.member_type='node' and em.member_id in (#{visible_nodes.keys.join(',')})")
-    end
-    if way_ids.length > 0
-        relations += Relation.find_by_sql("select e.* from current_relations e,current_relation_members em where " +
-            "e.visible=1 and " +
-            "em.id = e.id and em.member_type='way' and em.member_id in (#{way_ids.join(',')})")
-    end
+    relations = visible_nodes.values.collect { |node| node.containing_relations.visible }.flatten +
+                way_ids.collect { |id| Way.find(id).containing_relations.visible }.flatten
+
     # we do not normally return the "other" partners referenced by an relation, 
     # e.g. if we return a way A that is referenced by relation X, and there's 
     # another way B also referenced, that is not returned. But we do make 
     # an exception for cases where an relation references another *relation*; 
     # in that case we return that as well (but we don't go recursive here)
-    relation_ids = relations.collect { |relation| relation.id }
-    if relation_ids.length > 0
-        relations += Relation.find_by_sql("select e.* from current_relations e,current_relation_members em where " +
-            "e.visible=1 and " +
-            "em.id = e.id and em.member_type='relation' and em.member_id in (#{relation_ids.join(',')})")
-    end
+    relations += relations.collect { |relation| relation.containing_relations.visible }.flatten
 
     # this "uniq" may be slightly inefficient; it may be better to first collect and output
     # all node-related relations, then find the *not yet covered* way-related ones etc.
@@ -201,6 +184,8 @@ class ApiController < ApplicationController
       doc.root << relation.to_xml_node(user_display_name_cache)
     end
 
+    response.headers["Content-Disposition"] = "attachment; filename=\"map.osm\""
+
     render :text => doc.to_s, :content_type => "text/xml"
     
     #exit when we have too many requests