Check that the token is valid before using it.

[rails.git] / app / views / site / edit.html.erb

diff --git a/app/views/site/edit.html.erb b/app/views/site/edit.html.erb
index d7c47101a6c707369a1e2eff5e777be8c638e9b0..779abd352b659324992a20c4efd53fc924180066 100644 (file)
--- a/app/views/site/edit.html.erb
+++ b/app/views/site/edit.html.erb
@@ -8,11 +8,11 @@
 <p><%= t 'site.edit.not_public' %></p>
 <p><%= t 'site.edit.not_public_description', 
 :user_page => (link_to t('site.edit.user_page_link'), {:controller => 'user', :action => 'account', :display_name => @user.display_name, :anchor => 'public'}) %></p>
-<p><%= t 'site.edit.anon_edits', :link => link_to(t('site.edit.anon_edit_link_text'), t('site.edit.anon_edits_link')) %> (<a href=""></a>)</p>
+<p><%= t 'site.edit.anon_edits', :link => link_to(t('site.edit.anon_edits_link_text'), t('site.edit.anon_edits_link')) %></p>
 <% else %>
 <% content_for :greeting do %>
 <% if @user and !@user.home_lon.nil? and !@user.home_lat.nil? %>
-<%= link_to_function 'home', "setPosition(#{@user.home_lat}, #{@user.home_lon}, 10)" %> |
+<%= link_to_function t('layouts.home'), "setPosition(#{@user.home_lat}, #{@user.home_lon}, 10)", { :title => t('layouts.home_tooltip') } %> |
 <% end %>
 <% end %>
 
@@ -20,7 +20,7 @@
 <%= render :partial => 'search' %>
 
 <%
-session[:token] = @user.tokens.create.token unless session[:token]
+session[:token] = @user.tokens.create.token unless session[:token] and UserToken.find_by_token(session[:token])
 
 # Decide on a lat lon to initialise potlatch with. Various ways of doing this
 if params['lon'] and params['lat']
@@ -65,7 +65,7 @@ zoom='14' if zoom.nil?
   
   window.onbeforeunload=function() {
     if (!changesaved) {
-      return "<%= t 'site.edit.potlatch_unsaved_changes' %>";
+      return '<%= escape_javascript(t('site.edit.potlatch_unsaved_changes')) %>';
     }
   }
 
@@ -78,16 +78,17 @@ zoom='14' if zoom.nil?
     fo.addVariable('token','<%= session[:token] %>');
     if (lat) { fo.addVariable('lat',lat); }
     if (lon) { fo.addVariable('long',lon); }
-    <% if params['gpx']  %>fo.addVariable('gpx' ,'<%= h(params['gpx'] ) %>');<% end %>
-    <% if params['way']  %>fo.addVariable('way' ,'<%= h(params['way'] ) %>');<% end %>
-    <% if params['node'] %>fo.addVariable('node','<%= h(params['node']) %>');<% end %>
+    <% if params['gpx']     %>fo.addVariable('gpx'     ,'<%= h(params['gpx']    ) %>');<% end %>
+    <% if params['way']     %>fo.addVariable('way'     ,'<%= h(params['way']    ) %>');<% end %>
+    <% if params['node']    %>fo.addVariable('node'    ,'<%= h(params['node']   ) %>');<% end %>
+    <% if params['tileurl'] %>fo.addVariable('custombg','<%= h(params['tileurl']) %>');<% end %>
     fo.write("map");
   }
 
   doSWF(<%= lat || 'null' %>,<%= lon || 'null' %>,<%= zoom %>);
 
   function setPosition(lat, lon, zoom) {
-    doSWF(lat, lon, zoom);
+    doSWF(lat, lon, zoom || 15);
   }
 
   function resizeContent() {