Bounding boxes are sanitised on creation now

[rails.git] / app / controllers / changeset_controller.rb

diff --git a/app/controllers/changeset_controller.rb b/app/controllers/changeset_controller.rb
index 9fc2bc320315ce06e2c31bffbc80f2c929c075aa..b736e332b04431d3e6e0cc1cb76484c406fd313f 100644 (file)
--- a/app/controllers/changeset_controller.rb
+++ b/app/controllers/changeset_controller.rb
@@ -266,6 +266,15 @@ class ChangesetController < ApplicationController
           return
         end
       end
           return
         end
       end

+      
+      if params[:friends]
+        if @user
+          changesets = changesets.where(:user_id => @user.friend_users.public)
+        elsif request.format == :html
+          require_user
+          return
+        end
+      end

 
       if params[:bbox]
         bbox = BoundingBox.from_bbox_params(params)
 
       if params[:bbox]
         bbox = BoundingBox.from_bbox_params(params)


@@ -282,7 +291,11 @@ class ChangesetController < ApplicationController
         user_link = render_to_string :partial => "user", :object => user
       end
       
         user_link = render_to_string :partial => "user", :object => user
       end
       

-      if user and bbox
+      if params[:friends] and @user
+        @title =  t 'changeset.list.title_friend'
+        @heading =  t 'changeset.list.heading_friend'
+        @description = t 'changeset.list.description_friend'
+      elsif user and bbox

         @title =  t 'changeset.list.title_user_bbox', :user => user.display_name, :bbox => bbox.to_s
         @heading =  t 'changeset.list.heading_user_bbox', :user => user.display_name, :bbox => bbox.to_s
         @description = t 'changeset.list.description_user_bbox', :user => user_link, :bbox => bbox_link
         @title =  t 'changeset.list.title_user_bbox', :user => user.display_name, :bbox => bbox.to_s
         @heading =  t 'changeset.list.heading_user_bbox', :user => user.display_name, :bbox => bbox.to_s
         @description = t 'changeset.list.description_user_bbox', :user => user_link, :bbox => bbox_link