X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/0e2a66e8de55b3719bd307261058b7f898598994..20ce10a9ef722cc95402ad2e488b56f32f8169e1:/app/controllers/application_controller.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 68baa3115..052858932 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -23,7 +23,11 @@ class ApplicationController < ActionController::Base
     if session[:user]
       self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first
 
-      if current_user.status == "suspended"
+      if session[:fingerprint] &&
+         session[:fingerprint] != current_user.fingerprint
+        reset_session
+        self.current_user = nil
+      elsif current_user.status == "suspended"
         session.delete(:user)
         session_expires_automatically
 
@@ -42,6 +46,8 @@ class ApplicationController < ActionController::Base
     elsif session[:token]
       session[:user] = current_user.id if self.current_user = User.authenticate(:token => session[:token])
     end
+
+    session[:fingerprint] = current_user.fingerprint if current_user && session[:fingerprint].nil?
   rescue StandardError => e
     logger.info("Exception authorizing user: #{e}")
     reset_session
@@ -216,26 +222,22 @@ class ApplicationController < ActionController::Base
   # asserts that the request method is the +method+ given as a parameter
   # or raises a suitable error. +method+ should be a symbol, e.g: :put or :get.
   def assert_method(method)
-    ok = request.send((method.to_s.downcase + "?").to_sym)
+    ok = request.send(:"#{method.to_s.downcase}?")
     raise OSM::APIBadMethodError, method unless ok
   end
 
   ##
   # wrap an api call in a timeout
-  def api_call_timeout
-    OSM::Timer.timeout(Settings.api_timeout, Timeout::Error) do
-      yield
-    end
+  def api_call_timeout(&block)
+    OSM::Timer.timeout(Settings.api_timeout, Timeout::Error, &block)
   rescue Timeout::Error
     raise OSM::APITimeoutError
   end
 
   ##
   # wrap a web page in a timeout
-  def web_timeout
-    OSM::Timer.timeout(Settings.web_timeout, Timeout::Error) do
-      yield
-    end
+  def web_timeout(&block)
+    OSM::Timer.timeout(Settings.web_timeout, Timeout::Error, &block)
   rescue ActionView::Template::Error => e
     e = e.cause