Add support for ACL blocks on note commenting

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index 76c97ba5b3799770c3e3f55fe212efa426b489d3..acd88be04329d7f0760ee0e52b69976df581a4d3 100644 (file)
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -53,6 +53,9 @@ class NotesController < ApplicationController
   ##
   # Create a new note
   def create
+    # Check the ACLs
+    raise OSM::APIAccessDenied if Acl.no_note_comment(request.remote_ip)
+
     # Check the arguments are sane
     raise OSM::APIBadUserInput.new("No lat was given") unless params[:lat]
     raise OSM::APIBadUserInput.new("No lon was given") unless params[:lon]
@@ -86,6 +89,9 @@ class NotesController < ApplicationController
   ##
   # Add a comment to an existing note
   def comment
+    # Check the ACLs
+    raise OSM::APIAccessDenied if Acl.no_note_comment(request.remote_ip)
+
     # Check the arguments are sane
     raise OSM::APIBadUserInput.new("No id was given") unless params[:id]
     raise OSM::APIBadUserInput.new("No text was given") if params[:text].blank?

diff --git a/app/models/acl.rb b/app/models/acl.rb
index 2db7fb76522a0342324d235367ae51d0c5932c97..e2f163ea585bf8bd5453208c7da72dc24d360548 100644 (file)
--- a/app/models/acl.rb
+++ b/app/models/acl.rb
@@ -11,6 +11,10 @@ class Acl < ActiveRecord::Base
     self.match(address, domain).where(:k => "no_account_creation").exists?
   end
 
+  def self.no_note_comment(address, domain = nil)
+    self.match(address, domain).where(:k => "no_note_comment").exists?
+  end
+
   def self.no_trace_download(address, domain = nil)
     self.match(address, domain).where(:k => "no_trace_download").exists?
   end

diff --git a/lib/osm.rb b/lib/osm.rb
index 9e819829921f68f0b8b74c5a70f4b407b6cf0570..daef8d3f0edcb27a219c92f0fc35f05a860c1d62 100644 (file)
--- a/lib/osm.rb
+++ b/lib/osm.rb
@@ -24,6 +24,17 @@ module OSM
     end
   end
 
+  # Raised when access is denied.
+  class APIAccessDenied < RuntimeError
+    def status
+      :forbidden
+    end
+
+    def to_s
+      "Access denied"
+    end
+  end
+
   # Raised when an API object is not found.
   class APINotFoundError < APIError
     def status