Ooops. Added missing access control to changeset controller.

diff --git a/app/controllers/changeset_controller.rb b/app/controllers/changeset_controller.rb
index c56e15c0186a74d2f66ea28075da65710c4ca0a5..9152df81671525f3b4f84409b76fb9c75d78cb33 100644 (file)
--- a/app/controllers/changeset_controller.rb
+++ b/app/controllers/changeset_controller.rb
@@ -41,7 +41,13 @@ class ChangesetController < ApplicationController
         render :nothing => true, :status => :method_not_allowed
         return
       end
+
       changeset = Changeset.find(params[:id])
+
+      unless @user.id == changeset.user_id 
+        raise OSM::APIUserChangesetMismatchError 
+      end
+
       changeset.open = false
       changeset.save!
       render :nothing => true
@@ -61,6 +67,12 @@ class ChangesetController < ApplicationController
     if request.post?
       cs = Changeset.find(params[:id])
 
+      # check user credentials - only the user who opened a changeset
+      # may alter it.
+      unless @user.id == changeset.user_id 
+        raise OSM::APIUserChangesetMismatchError 
+      end
+
       # keep an array of lons and lats
       lon = Array.new
       lat = Array.new
@@ -120,6 +132,12 @@ class ChangesetController < ApplicationController
       return
     end
 
+    # access control - only the user who created a changeset may
+    # upload to it.
+    unless @user.id == changeset.user_id 
+      raise OSM::APIUserChangesetMismatchError 
+    end
+
     changeset = Changeset.find(params[:id])
     
     diff_reader = DiffReader.new(request.raw_post, changeset)