X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/501d13e1c0936cc3ba3d9639620517bae34e5784..0db30c611a99d62381217d86c5a0bd9d104efb42:/app/controllers/site_controller.rb diff --git a/app/controllers/site_controller.rb b/app/controllers/site_controller.rb index e76ee97f6..3a69eed12 100644 --- a/app/controllers/site_controller.rb +++ b/app/controllers/site_controller.rb @@ -1,58 +1,55 @@ class SiteController < ApplicationController - layout 'site' + layout "site" layout :map_layout, :only => [:index, :export] - before_filter :authorize_web - before_filter :set_locale - before_filter :redirect_browse_params, :only => :index - before_filter :redirect_map_params, :only => [:index, :edit, :export] - before_filter :require_user, :only => [:welcome] - before_filter :require_oauth, :only => [:index] + before_action :authorize_web + before_action :set_locale + before_action :redirect_browse_params, :only => :index + before_action :redirect_map_params, :only => [:index, :edit, :export] + before_action :require_oauth, :only => [:index] + before_action :update_totp, :only => [:index] + + authorize_resource :class => false def index - unless STATUS == :database_readonly or STATUS == :database_offline - session[:location] ||= OSM::IPLocation(request.env['REMOTE_ADDR']) - end + session[:location] ||= OSM.ip_location(request.env["REMOTE_ADDR"]) unless Settings.status == "database_readonly" || Settings.status == "database_offline" end def permalink - lon, lat, zoom = ShortLink::decode(params[:code]) + lon, lat, zoom = ShortLink.decode(params[:code]) new_params = params.except(:code, :lon, :lat, :zoom, :layers, :node, :way, :relation, :changeset) - if new_params.has_key? :m + if new_params.key? :m new_params.delete :m new_params[:mlat] = lat new_params[:mlon] = lon end - if params.has_key? :node - new_params[:controller] = 'browse' - new_params[:action] = 'node' + if params.key? :node + new_params[:controller] = "browse" + new_params[:action] = "node" new_params[:id] = params[:node] - elsif params.has_key? :way - new_params[:controller] = 'browse' - new_params[:action] = 'way' + elsif params.key? :way + new_params[:controller] = "browse" + new_params[:action] = "way" new_params[:id] = params[:way] - elsif params.has_key? :relation - new_params[:controller] = 'browse' - new_params[:action] = 'relation' + elsif params.key? :relation + new_params[:controller] = "browse" + new_params[:action] = "relation" new_params[:id] = params[:relation] - elsif params.has_key? :changeset - new_params[:controller] = 'browse' - new_params[:action] = 'changeset' + elsif params.key? :changeset + new_params[:controller] = "browse" + new_params[:action] = "changeset" new_params[:id] = params[:changeset] else - new_params[:controller] = 'site' - new_params[:action] = 'index' + new_params[:controller] = "site" + new_params[:action] = "index" end new_params[:anchor] = "map=#{zoom}/#{lat}/#{lon}" + new_params[:anchor] += "&layers=#{params[:layers]}" if params.key? :layers - if params.has_key? :layers - new_params[:anchor] += "&layers=#{params[:layers]}" - end - - redirect_to Hash[new_params] + redirect_to new_params.to_unsafe_h end def key @@ -71,26 +68,39 @@ class SiteController < ApplicationController require_user end - if params[:node] - bbox = Node.find(params[:node]).bbox.to_unscaled - @lat = bbox.centre_lat - @lon = bbox.centre_lon - @zoom = 18 - elsif params[:way] - bbox = Way.find(params[:way]).bbox.to_unscaled - @lat = bbox.centre_lat - @lon = bbox.centre_lon - @zoom = 17 - elsif params[:note] - note = Note.find(params[:note]) - @lat = note.lat - @lon = note.lon - @zoom = 17 - elsif params[:gpx] - trace = Trace.visible_to(@user).find(params[:gpx]) - @lat = trace.latitude - @lon = trace.longitude - @zoom = 16 + if %w[potlatch potlatch2].include?(editor) + append_content_security_policy_directives( + :connect_src => %w[*], + :object_src => %w[*], + :plugin_types => %w[application/x-shockwave-flash], + :script_src => %w['unsafe-inline'] + ) + end + + begin + if params[:node] + bbox = Node.visible.find(params[:node]).bbox.to_unscaled + @lat = bbox.centre_lat + @lon = bbox.centre_lon + @zoom = 18 + elsif params[:way] + bbox = Way.visible.find(params[:way]).bbox.to_unscaled + @lat = bbox.centre_lat + @lon = bbox.centre_lon + @zoom = 17 + elsif params[:note] + note = Note.visible.find(params[:note]) + @lat = note.lat + @lon = note.lon + @zoom = 17 + elsif params[:gpx] && current_user + trace = Trace.visible_to(current_user).find(params[:gpx]) + @lat = trace.latitude + @lon = trace.longitude + @zoom = 16 + end + rescue ActiveRecord::RecordNotFound + # don't try and derive a location from a missing/deleted object end end @@ -98,27 +108,29 @@ class SiteController < ApplicationController @locale = params[:copyright_locale] || I18n.locale end - def welcome - end + def welcome; end - def help - end + def help; end - def about - end + def about; end - def export - end + def export; end - def offline - end + def offline; end def preview - render :text => RichText.new(params[:format], params[:text]).to_html + render :html => RichText.new(params[:type], params[:text]).to_html end def id - render "id", :layout => false + append_content_security_policy_directives( + :connect_src => %w[*], + :img_src => %w[* blob:], + :script_src => %w[dev.virtualearth.net 'unsafe-eval'], + :style_src => %w['unsafe-inline'] + ) + + render :layout => false end private @@ -140,18 +152,14 @@ class SiteController < ApplicationController def redirect_map_params anchor = [] - if params[:lat] && params[:lon] - anchor << "map=#{params.delete(:zoom) || 5}/#{params.delete(:lat)}/#{params.delete(:lon)}" - end + anchor << "map=#{params.delete(:zoom) || 5}/#{params.delete(:lat)}/#{params.delete(:lon)}" if params[:lat] && params[:lon] if params[:layers] anchor << "layers=#{params.delete(:layers)}" - elsif params.delete(:notes) == 'yes' + elsif params.delete(:notes) == "yes" anchor << "layers=N" end - if anchor.present? - redirect_to Hash[params].merge(:anchor => anchor.join('&')) - end + redirect_to params.to_unsafe_h.merge(:anchor => anchor.join("&")) if anchor.present? end end