X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/cba7945a5b409222301f7512e648866810cae4d9..89f8f7af3539588c234496dd769f9042199bd248:/app/controllers/application_controller.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index fb5614236..bee5e8169 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -12,6 +12,8 @@ class ApplicationController < ActionController::Base attr_accessor :current_user helper_method :current_user + private + def authorize_web if session[:user] self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first @@ -35,8 +37,8 @@ class ApplicationController < ActionController::Base elsif session[:token] session[:user] = current_user.id if self.current_user = User.authenticate(:token => session[:token]) end - rescue StandardError => ex - logger.info("Exception authorizing user: #{ex}") + rescue StandardError => e + logger.info("Exception authorizing user: #{e}") reset_session self.current_user = nil end @@ -71,60 +73,6 @@ class ApplicationController < ActionController::Base end end - ## - # sets up the current_user for use by other methods. this is mostly called - # from the authorize method, but can be called elsewhere if authorisation - # is optional. - def setup_user_auth - # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - end - - # have we identified the user? - if current_user - # check if the user has been banned - user_block = current_user.blocks.active.take - unless user_block.nil? - set_locale - if user_block.zero_hour? - report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden - else - report_error t("application.setup_user_auth.blocked"), :forbidden - end - end - - # if the user hasn't seen the contributor terms then don't - # allow editing - they have to go to the web site and see - # (but can decline) the CTs to continue. - if !current_user.terms_seen && flash[:skip_terms].nil? - set_locale - report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden - end - end - end - - def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") - # make the current_user object from any auth sources we have - setup_user_auth - - # handle authenticate pass/fail - unless current_user - # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - return false - end - end - def check_database_readable(need_api = false) if Settings.status == "database_offline" || (need_api && Settings.status == "api_offline") if request.xhr? @@ -182,12 +130,6 @@ class ApplicationController < ActionController::Base status end - def gpx_status - status = database_status - status = "offline" if status == "online" && Settings.status == "gpx_offline" - status - end - def require_public_data unless current_user.data_public? report_error "You must make your edits public to upload new data", :forbidden @@ -243,22 +185,22 @@ class ApplicationController < ActionController::Base def api_call_handle_error yield - rescue ActiveRecord::RecordNotFound => ex + rescue ActiveRecord::RecordNotFound => e head :not_found - rescue LibXML::XML::Error, ArgumentError => ex - report_error ex.message, :bad_request - rescue ActiveRecord::RecordInvalid => ex - message = "#{ex.record.class} #{ex.record.id}: " - ex.record.errors.each { |attr, msg| message << "#{attr}: #{msg} (#{ex.record[attr].inspect})" } + rescue LibXML::XML::Error, ArgumentError => e + report_error e.message, :bad_request + rescue ActiveRecord::RecordInvalid => e + message = "#{e.record.class} #{e.record.id}: " + e.record.errors.each { |attr, msg| message << "#{attr}: #{msg} (#{e.record[attr].inspect})" } report_error message, :bad_request - rescue OSM::APIError => ex - report_error ex.message, ex.status - rescue AbstractController::ActionNotFound => ex + rescue OSM::APIError => e + report_error e.message, e.status + rescue AbstractController::ActionNotFound => e raise - rescue StandardError => ex - logger.info("API threw unexpected #{ex.class} exception: #{ex.message}") - ex.backtrace.each { |l| logger.info(l) } - report_error "#{ex.class}: #{ex.message}", :internal_server_error + rescue StandardError => e + logger.info("API threw unexpected #{e.class} exception: #{e.message}") + e.backtrace.each { |l| logger.info(l) } + report_error "#{e.class}: #{e.message}", :internal_server_error end ## @@ -285,11 +227,11 @@ class ApplicationController < ActionController::Base OSM::Timer.timeout(Settings.web_timeout, Timeout::Error) do yield end - rescue ActionView::Template::Error => ex - ex = ex.cause + rescue ActionView::Template::Error => e + e = e.cause - if ex.is_a?(Timeout::Error) || - (ex.is_a?(ActiveRecord::StatementInvalid) && ex.message =~ /execution expired/) + if e.is_a?(Timeout::Error) || + (e.is_a?(ActiveRecord::StatementInvalid) && e.message =~ /execution expired/) render :action => "timeout" else raise @@ -387,23 +329,10 @@ class ApplicationController < ActionController::Base end def current_ability - # Use capabilities from the oauth token if it exists and is a valid access token - if Authenticator.new(self, [:token]).allow? - Ability.new(nil).merge(Capability.new(current_token)) - else - Ability.new(current_user) - end + Ability.new(current_user) end - def deny_access(exception) - if @api_deny_access_handling - api_deny_access(exception) - else - web_deny_access(exception) - end - end - - def web_deny_access(_exception) + def deny_access(_exception) if current_token set_locale report_error t("oauth.permissions.missing"), :forbidden @@ -423,28 +352,6 @@ class ApplicationController < ActionController::Base end end - def api_deny_access(_exception) - if current_token - set_locale - report_error t("oauth.permissions.missing"), :forbidden - elsif current_user - head :forbidden - else - realm = "Web Password" - errormessage = "Couldn't authenticate you" - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - end - end - - attr_accessor :api_access_handling - - def api_deny_access_handler - @api_deny_access_handling = true - end - - private - # extract authorisation credentials from headers, returns user = nil if none def get_auth_data if request.env.key? "X-HTTP_AUTHORIZATION" # where mod_rewrite might have put it