-# Filters added to this controller will be run for all controllers in the application.
-# Likewise, all the methods added will be available for all controllers.
class ApplicationController < ActionController::Base
+ protect_from_forgery
+
if STATUS == :database_readonly or STATUS == :database_offline
session :off
+
+ def self.cache_sweeper(*sweepers)
+ end
end
def authorize_web
@user = User.find(session[:user], :conditions => {:status => ["active", "confirmed", "suspended"]})
if @user.status == "suspended"
- session[:user] = nil
+ session.delete(:user)
session_expires_automatically
redirect_to :controller => "user", :action => "suspended"
if params[:referer]
redirect_to :controller => "user", :action => "terms", :referer => params[:referer]
else
- redirect_to :controller => "user", :action => "terms", :referer => request.request_uri
+ redirect_to :controller => "user", :action => "terms", :referer => request.fullpath
end
end
elsif session[:token]
end
def require_user
- redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri unless @user
+ redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath unless @user
end
##
# method, otherwise an OAuth token was used, which has to be checked.
unless current_token.nil?
unless current_token.read_attribute(cap)
- render :text => "OAuth token doesn't have that capability.", :status => :forbidden
+ report_error "OAuth token doesn't have that capability.", :forbidden
return false
end
end
end
def require_allow_write_api
require_capability(:allow_write_api)
+
+ if REQUIRE_TERMS_AGREED and @user.terms_agreed.nil?
+ report_error "You must accept the contributor terms before you can edit.", :forbidden
+ return false
+ end
end
def require_allow_read_gpx
require_capability(:allow_read_gpx)