X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/94d19ae567dc7723129ee2f00576023aaee18fc7..9153fd3559bea49d29b44a27e6fb4123dd103c25:/app/controllers/application_controller.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index c5545c068..bee5e8169 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -12,6 +12,8 @@ class ApplicationController < ActionController::Base attr_accessor :current_user helper_method :current_user + private + def authorize_web if session[:user] self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first @@ -35,8 +37,8 @@ class ApplicationController < ActionController::Base elsif session[:token] session[:user] = current_user.id if self.current_user = User.authenticate(:token => session[:token]) end - rescue StandardError => ex - logger.info("Exception authorizing user: #{ex}") + rescue StandardError => e + logger.info("Exception authorizing user: #{e}") reset_session self.current_user = nil end @@ -71,47 +73,6 @@ class ApplicationController < ActionController::Base end end - ## - # sets up the current_user for use by other methods. this is mostly called - # from the authorize method, but can be called elsewhere if authorisation - # is optional. - def setup_user_auth - # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - end - - # have we identified the user? - if current_user - # check if the user has been banned - user_block = current_user.blocks.active.take - unless user_block.nil? - set_locale - if user_block.zero_hour? - report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden - else - report_error t("application.setup_user_auth.blocked"), :forbidden - end - end - - # if the user hasn't seen the contributor terms then don't - # allow editing - they have to go to the web site and see - # (but can decline) the CTs to continue. - if !current_user.terms_seen && flash[:skip_terms].nil? - set_locale - report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden - end - end - end - def check_database_readable(need_api = false) if Settings.status == "database_offline" || (need_api && Settings.status == "api_offline") if request.xhr? @@ -134,14 +95,14 @@ class ApplicationController < ActionController::Base end def check_api_readable - if api_status == :offline + if api_status == "offline" report_error "Database offline for maintenance", :service_unavailable false end end def check_api_writable - unless api_status == :online + unless api_status == "online" report_error "Database offline for maintenance", :service_unavailable false end @@ -149,32 +110,26 @@ class ApplicationController < ActionController::Base def database_status if Settings.status == "database_offline" - :offline + "offline" elsif Settings.status == "database_readonly" - :readonly + "readonly" else - :online + "online" end end def api_status status = database_status - if status == :online + if status == "online" if Settings.status == "api_offline" - status = :offline + status = "offline" elsif Settings.status == "api_readonly" - status = :readonly + status = "readonly" end end status end - def gpx_status - status = database_status - status = :offline if status == :online && Settings.status == "gpx_offline" - status - end - def require_public_data unless current_user.data_public? report_error "You must make your edits public to upload new data", :forbidden @@ -230,22 +185,22 @@ class ApplicationController < ActionController::Base def api_call_handle_error yield - rescue ActiveRecord::RecordNotFound => ex + rescue ActiveRecord::RecordNotFound => e head :not_found - rescue LibXML::XML::Error, ArgumentError => ex - report_error ex.message, :bad_request - rescue ActiveRecord::RecordInvalid => ex - message = "#{ex.record.class} #{ex.record.id}: " - ex.record.errors.each { |attr, msg| message << "#{attr}: #{msg} (#{ex.record[attr].inspect})" } + rescue LibXML::XML::Error, ArgumentError => e + report_error e.message, :bad_request + rescue ActiveRecord::RecordInvalid => e + message = "#{e.record.class} #{e.record.id}: " + e.record.errors.each { |attr, msg| message << "#{attr}: #{msg} (#{e.record[attr].inspect})" } report_error message, :bad_request - rescue OSM::APIError => ex - report_error ex.message, ex.status - rescue AbstractController::ActionNotFound => ex + rescue OSM::APIError => e + report_error e.message, e.status + rescue AbstractController::ActionNotFound => e raise - rescue StandardError => ex - logger.info("API threw unexpected #{ex.class} exception: #{ex.message}") - ex.backtrace.each { |l| logger.info(l) } - report_error "#{ex.class}: #{ex.message}", :internal_server_error + rescue StandardError => e + logger.info("API threw unexpected #{e.class} exception: #{e.message}") + e.backtrace.each { |l| logger.info(l) } + report_error "#{e.class}: #{e.message}", :internal_server_error end ## @@ -272,11 +227,11 @@ class ApplicationController < ActionController::Base OSM::Timer.timeout(Settings.web_timeout, Timeout::Error) do yield end - rescue ActionView::Template::Error => ex - ex = ex.cause + rescue ActionView::Template::Error => e + e = e.cause - if ex.is_a?(Timeout::Error) || - (ex.is_a?(ActiveRecord::StatementInvalid) && ex.message =~ /execution expired/) + if e.is_a?(Timeout::Error) || + (e.is_a?(ActiveRecord::StatementInvalid) && e.message =~ /execution expired/) render :action => "timeout" else raise @@ -374,12 +329,7 @@ class ApplicationController < ActionController::Base end def current_ability - # Use capabilities from the oauth token if it exists and is a valid access token - if Authenticator.new(self, [:token]).allow? - Ability.new(nil).merge(Capability.new(current_token)) - else - Ability.new(current_user) - end + Ability.new(current_user) end def deny_access(_exception) @@ -402,8 +352,6 @@ class ApplicationController < ActionController::Base end end - private - # extract authorisation credentials from headers, returns user = nil if none def get_auth_data if request.env.key? "X-HTTP_AUTHORIZATION" # where mod_rewrite might have put it