Use CanCanCan for nodes, ways, relations, old and api controllers

[rails.git] / app / controllers / nodes_controller.rb

diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index baa6d8195abd92491f57d3e1794d6adeb119ab30..65f9b27ed1a64150c482ccf3c44c6af3d98a44e0 100644 (file)
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -5,7 +5,10 @@ class NodesController < ApplicationController
 
   skip_before_action :verify_authenticity_token
   before_action :authorize, :only => [:create, :update, :delete]
 
   skip_before_action :verify_authenticity_token
   before_action :authorize, :only => [:create, :update, :delete]

-  before_action :require_allow_write_api, :only => [:create, :update, :delete]
+  before_action :api_deny_access_handler
+
+  authorize_resource
+

   before_action :require_public_data, :only => [:create, :update, :delete]
   before_action :check_api_writable, :only => [:create, :update, :delete]
   before_action :check_api_readable, :except => [:create, :update, :delete]
   before_action :require_public_data, :only => [:create, :update, :delete]
   before_action :check_api_writable, :only => [:create, :update, :delete]
   before_action :check_api_readable, :except => [:create, :update, :delete]