X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/703c1a83e6b3de91be977b62a291e12f6577dcf3..c426e8d160101faaa414330a0ccd641d03bef65a:/app/controllers/user_controller.rb diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index 443c433a5..b61579d92 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -1,20 +1,22 @@ class UserController < ApplicationController layout :choose_layout - skip_before_filter :verify_authenticity_token, :only => [:api_details, :api_gpx_files] + skip_before_filter :verify_authenticity_token, :only => [:api_read, :api_details, :api_gpx_files] before_filter :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details] before_filter :authorize, :only => [:api_details, :api_gpx_files] - before_filter :authorize_web, :except => [:api_details, :api_gpx_files] - before_filter :set_locale, :except => [:api_details, :api_gpx_files] + before_filter :authorize_web, :except => [:api_read, :api_details, :api_gpx_files] + before_filter :set_locale, :except => [:api_read, :api_details, :api_gpx_files] before_filter :require_user, :only => [:account, :go_public, :make_friend, :remove_friend] - before_filter :check_database_readable, :except => [:login, :api_details, :api_gpx_files] + before_filter :check_database_readable, :except => [:login, :api_read, :api_details, :api_gpx_files] before_filter :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public, :make_friend, :remove_friend] - before_filter :check_api_readable, :only => [:api_details, :api_gpx_files] + before_filter :check_api_readable, :only => [:api_read, :api_details, :api_gpx_files] before_filter :require_allow_read_prefs, :only => [:api_details] before_filter :require_allow_read_gpx, :only => [:api_gpx_files] before_filter :require_cookies, :only => [:login, :confirm] before_filter :require_administrator, :only => [:set_status, :delete, :list] - before_filter :lookup_this_user, :only => [:set_status, :delete] + around_filter :api_call_handle_error, :only => [:api_read, :api_details, :api_gpx_files] + before_filter :lookup_user_by_id, :only => [:api_read] + before_filter :lookup_user_by_name, :only => [:set_status, :delete] cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete] @@ -49,8 +51,8 @@ class UserController < ApplicationController if params[:user] and params[:user][:openid_url] and @user.pass_crypt.empty? # We are creating an account with OpenID and no password # was specified so create a random one - @user.pass_crypt = SecureRandom.base64(16) - @user.pass_crypt_confirmation = @user.pass_crypt + @user.pass_crypt = SecureRandom.base64(16) + @user.pass_crypt_confirmation = @user.pass_crypt end if @user @@ -125,7 +127,7 @@ class UserController < ApplicationController @user.terms_agreed = Time.now.getutc @user.terms_seen = true @user.openid_url = nil if @user.openid_url and @user.openid_url.empty? - + if @user.save flash[:piwik_goal] = PIWIK_SIGNUP_GOAL if defined?(PIWIK_SIGNUP_GOAL) flash[:notice] = t 'user.new.flash create success message', :email => @user.email @@ -259,10 +261,6 @@ class UserController < ApplicationController else password_authentication(params[:username], params[:password]) end - elsif params[:notice] - flash.now[:notice] = t "user.login.notice_#{params[:notice]}" - elsif flash[:notice].nil? - flash.now[:notice] = t 'user.login.notice' end end @@ -301,7 +299,7 @@ class UserController < ApplicationController referer = token.referer token.destroy - if session[:token] + if session[:token] token = UserToken.find_by_token(session[:token]) session.delete(:token) else @@ -377,6 +375,15 @@ class UserController < ApplicationController end end + def api_read + render :nothing => true, :status => :gone unless @this_user.visible? + end + + def api_details + @this_user = @user + render :action => :api_read + end + def api_gpx_files doc = OSM::API.new.get_xml_doc @user.traces.each do |trace| @@ -397,47 +404,55 @@ class UserController < ApplicationController end def make_friend - if params[:display_name] - name = params[:display_name] - new_friend = User.active.where(:display_name => name).first - friend = Friend.new - friend.user_id = @user.id - friend.friend_user_id = new_friend.id - unless @user.is_friends_with?(new_friend) - if friend.save - flash[:notice] = t 'user.make_friend.success', :name => name - Notifier.friend_notification(friend).deliver + @new_friend = User.find_by_display_name(params[:display_name]) + + if @new_friend + if request.post? + friend = Friend.new + friend.user_id = @user.id + friend.friend_user_id = @new_friend.id + unless @user.is_friends_with?(@new_friend) + if friend.save + flash[:notice] = t 'user.make_friend.success', :name => @new_friend.display_name + Notifier.friend_notification(friend).deliver + else + friend.add_error(t('user.make_friend.failed', :name => @new_friend.display_name)) + end else - friend.add_error(t('user.make_friend.failed', :name => name)) + flash[:warning] = t 'user.make_friend.already_a_friend', :name => @new_friend.display_name end - else - flash[:warning] = t 'user.make_friend.already_a_friend', :name => name - end - if params[:referer] - redirect_to params[:referer] - else - redirect_to :controller => 'user', :action => 'view' + if params[:referer] + redirect_to params[:referer] + else + redirect_to :controller => 'user', :action => 'view' + end end + else + render_unknown_user params[:display_name] end end def remove_friend - if params[:display_name] - name = params[:display_name] - friend = User.active.where(:display_name => name).first - if @user.is_friends_with?(friend) - Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}" - flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name - else - flash[:error] = t 'user.remove_friend.not_a_friend', :name => friend.display_name - end + @friend = User.find_by_display_name(params[:display_name]) - if params[:referer] - redirect_to params[:referer] - else - redirect_to :controller => 'user', :action => 'view' + if @friend + if request.post? + if @user.is_friends_with?(@friend) + Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{@friend.id}" + flash[:notice] = t 'user.remove_friend.success', :name => @friend.display_name + else + flash[:error] = t 'user.remove_friend.not_a_friend', :name => @friend.display_name + end + + if params[:referer] + redirect_to params[:referer] + else + redirect_to :controller => 'user', :action => 'view' + end end + else + render_unknown_user params[:display_name] end end @@ -588,7 +603,7 @@ private else return openid_url end - end + end ## # process a successful login @@ -648,8 +663,15 @@ private user.languages = params[:user][:languages].split(",") case params[:image_action] - when "new" then user.image = params[:user][:image] - when "delete" then user.image = nil + when "new" then + user.image = params[:user][:image] + user.image_use_gravatar = false + when "delete" then + user.image = nil + user.image_use_gravatar = false + when "gravatar" then + user.image = nil + user.image_use_gravatar = true end user.home_lat = params[:user][:home_lat] @@ -710,7 +732,13 @@ private ## # ensure that there is a "this_user" instance variable - def lookup_this_user + def lookup_user_by_id + @this_user = User.find(params[:id]) + end + + ## + # ensure that there is a "this_user" instance variable + def lookup_user_by_name @this_user = User.find_by_display_name(params[:display_name]) rescue ActiveRecord::RecordNotFound redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] unless @this_user @@ -734,7 +762,7 @@ private ## # def disable_terms_redirect - # this is necessary otherwise going to the user terms page, when + # this is necessary otherwise going to the user terms page, when # having not agreed already would cause an infinite redirect loop. # it's .now so that this doesn't propagate to other pages. flash.now[:skip_terms] = true