From: Tom Hughes Date: Sat, 23 Mar 2019 12:08:41 +0000 (+0000) Subject: Merge remote-tracking branch 'upstream/pull/2131' X-Git-Tag: live~3276 X-Git-Url: https://git.openstreetmap.org./rails.git/commitdiff_plain/37f8f8a28caea936b53271c9f9de36cdbaf15d0e?hp=c1bf73bee42000aadb56cdaeab650e26a284b0b2 Merge remote-tracking branch 'upstream/pull/2131' --- diff --git a/app/controllers/api/amf_controller.rb b/app/controllers/api/amf_controller.rb index 509cf1d77..0cf511d76 100644 --- a/app/controllers/api/amf_controller.rb +++ b/app/controllers/api/amf_controller.rb @@ -36,10 +36,9 @@ # * version conflict when POIs and ways are reverted module Api - class AmfController < ApplicationController + class AmfController < ApiController include Potlatch - skip_before_action :verify_authenticity_token before_action :check_api_writable # AMF Controller implements its own authentication and authorization checks diff --git a/app/controllers/api/capabilities_controller.rb b/app/controllers/api/capabilities_controller.rb index 8337bc809..7f91557f8 100644 --- a/app/controllers/api/capabilities_controller.rb +++ b/app/controllers/api/capabilities_controller.rb @@ -1,8 +1,5 @@ module Api - class CapabilitiesController < ApplicationController - skip_before_action :verify_authenticity_token - before_action :api_deny_access_handler - + class CapabilitiesController < ApiController authorize_resource :class => false around_action :api_call_handle_error, :api_call_timeout diff --git a/app/controllers/api/changes_controller.rb b/app/controllers/api/changes_controller.rb index c9195e1d9..7170e1562 100644 --- a/app/controllers/api/changes_controller.rb +++ b/app/controllers/api/changes_controller.rb @@ -1,8 +1,5 @@ module Api - class ChangesController < ApplicationController - skip_before_action :verify_authenticity_token - before_action :api_deny_access_handler - + class ChangesController < ApiController authorize_resource :class => false before_action :check_api_readable diff --git a/app/controllers/api/changeset_comments_controller.rb b/app/controllers/api/changeset_comments_controller.rb index 0bebce433..21c854139 100644 --- a/app/controllers/api/changeset_comments_controller.rb +++ b/app/controllers/api/changeset_comments_controller.rb @@ -1,8 +1,6 @@ module Api - class ChangesetCommentsController < ApplicationController - skip_before_action :verify_authenticity_token + class ChangesetCommentsController < ApiController before_action :authorize - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/changesets_controller.rb b/app/controllers/api/changesets_controller.rb index dd43f7ed0..fb6523f4e 100644 --- a/app/controllers/api/changesets_controller.rb +++ b/app/controllers/api/changesets_controller.rb @@ -1,20 +1,17 @@ # The ChangesetController is the RESTful interface to Changeset objects module Api - class ChangesetsController < ApplicationController + class ChangesetsController < ApiController layout "site" require "xml/libxml" - skip_before_action :verify_authenticity_token before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe] - before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox] authorize_resource before_action :require_public_data, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe] before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe] before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :subscribe, :unsubscribe] - before_action(:only => [:index, :feed]) { |c| c.check_database_readable(true) } around_action :api_call_handle_error around_action :api_call_timeout, :except => [:upload] diff --git a/app/controllers/api/map_controller.rb b/app/controllers/api/map_controller.rb index e8d36c8ec..27d6f3667 100644 --- a/app/controllers/api/map_controller.rb +++ b/app/controllers/api/map_controller.rb @@ -1,8 +1,5 @@ module Api - class MapController < ApplicationController - skip_before_action :verify_authenticity_token - before_action :api_deny_access_handler - + class MapController < ApiController authorize_resource :class => false before_action :check_api_readable diff --git a/app/controllers/api/nodes_controller.rb b/app/controllers/api/nodes_controller.rb index 4e46b38d5..5218159c1 100644 --- a/app/controllers/api/nodes_controller.rb +++ b/app/controllers/api/nodes_controller.rb @@ -1,12 +1,10 @@ # The NodeController is the RESTful interface to Node objects module Api - class NodesController < ApplicationController + class NodesController < ApiController require "xml/libxml" - skip_before_action :verify_authenticity_token before_action :authorize, :only => [:create, :update, :delete] - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/notes_controller.rb b/app/controllers/api/notes_controller.rb index 686e76b14..20a24ce99 100644 --- a/app/controllers/api/notes_controller.rb +++ b/app/controllers/api/notes_controller.rb @@ -1,12 +1,10 @@ module Api - class NotesController < ApplicationController + class NotesController < ApiController layout "site", :only => [:mine] - skip_before_action :verify_authenticity_token before_action :check_api_readable before_action :setup_user_auth, :only => [:create, :comment, :show] before_action :authorize, :only => [:close, :reopen, :destroy] - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/old_controller.rb b/app/controllers/api/old_controller.rb index 9a86bded5..fa2b5814e 100644 --- a/app/controllers/api/old_controller.rb +++ b/app/controllers/api/old_controller.rb @@ -2,12 +2,10 @@ # into one place. as it turns out, the API methods for historical # nodes, ways and relations are basically identical. module Api - class OldController < ApplicationController + class OldController < ApiController require "xml/libxml" - skip_before_action :verify_authenticity_token before_action :setup_user_auth, :only => [:history, :version] - before_action :api_deny_access_handler before_action :authorize, :only => [:redact] authorize_resource diff --git a/app/controllers/api/permissions_controller.rb b/app/controllers/api/permissions_controller.rb index b24aca776..9b168e04b 100644 --- a/app/controllers/api/permissions_controller.rb +++ b/app/controllers/api/permissions_controller.rb @@ -1,8 +1,5 @@ module Api - class PermissionsController < ApplicationController - skip_before_action :verify_authenticity_token - before_action :api_deny_access_handler - + class PermissionsController < ApiController authorize_resource :class => false before_action :check_api_readable diff --git a/app/controllers/api/relations_controller.rb b/app/controllers/api/relations_controller.rb index a0740b382..b7d990c3d 100644 --- a/app/controllers/api/relations_controller.rb +++ b/app/controllers/api/relations_controller.rb @@ -1,10 +1,8 @@ module Api - class RelationsController < ApplicationController + class RelationsController < ApiController require "xml/libxml" - skip_before_action :verify_authenticity_token before_action :authorize, :only => [:create, :update, :delete] - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/search_controller.rb b/app/controllers/api/search_controller.rb index 0afbbf8e2..feb487ac0 100644 --- a/app/controllers/api/search_controller.rb +++ b/app/controllers/api/search_controller.rb @@ -1,9 +1,8 @@ module Api - class SearchController < ApplicationController + class SearchController < ApiController # Support searching for nodes, ways, or all # Can search by tag k, v, or both (type->k,value->v) # Can search by name (k=name,v=....) - skip_before_action :verify_authenticity_token authorize_resource :class => false def search_all diff --git a/app/controllers/api/swf_controller.rb b/app/controllers/api/swf_controller.rb index d48731b70..2f8a5392d 100644 --- a/app/controllers/api/swf_controller.rb +++ b/app/controllers/api/swf_controller.rb @@ -1,6 +1,5 @@ module Api - class SwfController < ApplicationController - skip_before_action :verify_authenticity_token + class SwfController < ApiController before_action :check_api_readable authorize_resource :class => false diff --git a/app/controllers/api/tracepoints_controller.rb b/app/controllers/api/tracepoints_controller.rb index c71b5a3e9..b22bcfaea 100644 --- a/app/controllers/api/tracepoints_controller.rb +++ b/app/controllers/api/tracepoints_controller.rb @@ -1,8 +1,5 @@ module Api - class TracepointsController < ApplicationController - skip_before_action :verify_authenticity_token - before_action :api_deny_access_handler - + class TracepointsController < ApiController authorize_resource before_action :check_api_readable diff --git a/app/controllers/api/traces_controller.rb b/app/controllers/api/traces_controller.rb index d7f2f043a..47dd152a3 100644 --- a/app/controllers/api/traces_controller.rb +++ b/app/controllers/api/traces_controller.rb @@ -1,12 +1,10 @@ module Api - class TracesController < ApplicationController + class TracesController < ApiController layout "site", :except => :georss - skip_before_action :verify_authenticity_token before_action :authorize_web before_action :set_locale before_action :authorize - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/user_preferences_controller.rb b/app/controllers/api/user_preferences_controller.rb index 82f6c6a4d..39e0dff30 100644 --- a/app/controllers/api/user_preferences_controller.rb +++ b/app/controllers/api/user_preferences_controller.rb @@ -1,7 +1,6 @@ # Update and read user preferences, which are arbitrayr key/val pairs module Api - class UserPreferencesController < ApplicationController - skip_before_action :verify_authenticity_token + class UserPreferencesController < ApiController before_action :authorize authorize_resource diff --git a/app/controllers/api/users_controller.rb b/app/controllers/api/users_controller.rb index 70ad93f65..f24d50cf1 100644 --- a/app/controllers/api/users_controller.rb +++ b/app/controllers/api/users_controller.rb @@ -1,11 +1,9 @@ module Api - class UsersController < ApplicationController + class UsersController < ApiController layout "site", :except => [:api_details] - skip_before_action :verify_authenticity_token before_action :disable_terms_redirect, :only => [:api_details] before_action :authorize, :only => [:api_details, :api_gpx_files] - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api/ways_controller.rb b/app/controllers/api/ways_controller.rb index 8684c5cfb..5e3e5e11a 100644 --- a/app/controllers/api/ways_controller.rb +++ b/app/controllers/api/ways_controller.rb @@ -1,10 +1,8 @@ module Api - class WaysController < ApplicationController + class WaysController < ApiController require "xml/libxml" - skip_before_action :verify_authenticity_token before_action :authorize, :only => [:create, :update, :delete] - before_action :api_deny_access_handler authorize_resource diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb new file mode 100644 index 000000000..579af27cf --- /dev/null +++ b/app/controllers/api_controller.rb @@ -0,0 +1,79 @@ +class ApiController < ApplicationController + skip_before_action :verify_authenticity_token + + private + + def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") + # make the current_user object from any auth sources we have + setup_user_auth + + # handle authenticate pass/fail + unless current_user + # no auth, the user does not exist or the password was wrong + response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" + render :plain => errormessage, :status => :unauthorized + return false + end + end + + def deny_access(_exception) + if current_token + set_locale + report_error t("oauth.permissions.missing"), :forbidden + elsif current_user + head :forbidden + else + realm = "Web Password" + errormessage = "Couldn't authenticate you" + response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" + render :plain => errormessage, :status => :unauthorized + end + end + + def gpx_status + status = database_status + status = "offline" if status == "online" && Settings.status == "gpx_offline" + status + end + + ## + # sets up the current_user for use by other methods. this is mostly called + # from the authorize method, but can be called elsewhere if authorisation + # is optional. + def setup_user_auth + # try and setup using OAuth + unless Authenticator.new(self, [:token]).allow? + username, passwd = get_auth_data # parse from headers + # authenticate per-scheme + self.current_user = if username.nil? + nil # no authentication provided - perhaps first connect (client should retry after 401) + elsif username == "token" + User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth + else + User.authenticate(:username => username, :password => passwd) # basic auth + end + end + + # have we identified the user? + if current_user + # check if the user has been banned + user_block = current_user.blocks.active.take + unless user_block.nil? + set_locale + if user_block.zero_hour? + report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden + else + report_error t("application.setup_user_auth.blocked"), :forbidden + end + end + + # if the user hasn't seen the contributor terms then don't + # allow editing - they have to go to the web site and see + # (but can decline) the CTs to continue. + if !current_user.terms_seen && flash[:skip_terms].nil? + set_locale + report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden + end + end + end +end diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 8d9ee11f9..3ab09b63d 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -12,6 +12,8 @@ class ApplicationController < ActionController::Base attr_accessor :current_user helper_method :current_user + private + def authorize_web if session[:user] self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first @@ -71,60 +73,6 @@ class ApplicationController < ActionController::Base end end - ## - # sets up the current_user for use by other methods. this is mostly called - # from the authorize method, but can be called elsewhere if authorisation - # is optional. - def setup_user_auth - # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - end - - # have we identified the user? - if current_user - # check if the user has been banned - user_block = current_user.blocks.active.take - unless user_block.nil? - set_locale - if user_block.zero_hour? - report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden - else - report_error t("application.setup_user_auth.blocked"), :forbidden - end - end - - # if the user hasn't seen the contributor terms then don't - # allow editing - they have to go to the web site and see - # (but can decline) the CTs to continue. - if !current_user.terms_seen && flash[:skip_terms].nil? - set_locale - report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden - end - end - end - - def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") - # make the current_user object from any auth sources we have - setup_user_auth - - # handle authenticate pass/fail - unless current_user - # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - return false - end - end - def check_database_readable(need_api = false) if Settings.status == "database_offline" || (need_api && Settings.status == "api_offline") if request.xhr? @@ -147,14 +95,14 @@ class ApplicationController < ActionController::Base end def check_api_readable - if api_status == :offline + if api_status == "offline" report_error "Database offline for maintenance", :service_unavailable false end end def check_api_writable - unless api_status == :online + unless api_status == "online" report_error "Database offline for maintenance", :service_unavailable false end @@ -162,32 +110,26 @@ class ApplicationController < ActionController::Base def database_status if Settings.status == "database_offline" - :offline + "offline" elsif Settings.status == "database_readonly" - :readonly + "readonly" else - :online + "online" end end def api_status status = database_status - if status == :online + if status == "online" if Settings.status == "api_offline" - status = :offline + status = "offline" elsif Settings.status == "api_readonly" - status = :readonly + status = "readonly" end end status end - def gpx_status - status = database_status - status = :offline if status == :online && Settings.status == "gpx_offline" - status - end - def require_public_data unless current_user.data_public? report_error "You must make your edits public to upload new data", :forbidden @@ -395,15 +337,7 @@ class ApplicationController < ActionController::Base end end - def deny_access(exception) - if @api_deny_access_handling - api_deny_access(exception) - else - web_deny_access(exception) - end - end - - def web_deny_access(_exception) + def deny_access(_exception) if current_token set_locale report_error t("oauth.permissions.missing"), :forbidden @@ -423,28 +357,6 @@ class ApplicationController < ActionController::Base end end - def api_deny_access(_exception) - if current_token - set_locale - report_error t("oauth.permissions.missing"), :forbidden - elsif current_user - head :forbidden - else - realm = "Web Password" - errormessage = "Couldn't authenticate you" - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - end - end - - attr_accessor :api_access_handling - - def api_deny_access_handler - @api_deny_access_handling = true - end - - private - # extract authorisation credentials from headers, returns user = nil if none def get_auth_data if request.env.key? "X-HTTP_AUTHORIZATION" # where mod_rewrite might have put it diff --git a/app/controllers/browse_controller.rb b/app/controllers/browse_controller.rb index 0fccbb506..ebdd2cd80 100644 --- a/app/controllers/browse_controller.rb +++ b/app/controllers/browse_controller.rb @@ -3,7 +3,7 @@ class BrowseController < ApplicationController before_action :authorize_web before_action :set_locale - before_action(:except => [:query]) { |c| c.check_database_readable(true) } + before_action -> { check_database_readable(true) } before_action :require_oauth around_action :web_timeout authorize_resource :class => false diff --git a/app/controllers/changeset_comments_controller.rb b/app/controllers/changeset_comments_controller.rb index 05b28eacf..4abffb90e 100644 --- a/app/controllers/changeset_comments_controller.rb +++ b/app/controllers/changeset_comments_controller.rb @@ -4,7 +4,7 @@ class ChangesetCommentsController < ApplicationController authorize_resource - before_action(:only => [:index]) { |c| c.check_database_readable(true) } + before_action -> { check_database_readable(true) } around_action :web_timeout ## diff --git a/app/controllers/changesets_controller.rb b/app/controllers/changesets_controller.rb index fff9f543b..32d9fd733 100644 --- a/app/controllers/changesets_controller.rb +++ b/app/controllers/changesets_controller.rb @@ -7,7 +7,7 @@ class ChangesetsController < ApplicationController skip_before_action :verify_authenticity_token, :except => [:index] before_action :authorize_web before_action :set_locale - before_action(:only => [:index, :feed]) { |c| c.check_database_readable(true) } + before_action -> { check_database_readable(true) }, :only => [:index, :feed] authorize_resource diff --git a/config/locales/cs.yml b/config/locales/cs.yml index 33199c1ab..4c890b766 100644 --- a/config/locales/cs.yml +++ b/config/locales/cs.yml @@ -1451,11 +1451,16 @@ cs: contributors_si_html: 'Slovinsko: Obsahuje data Zeměměřického a mapovacího úřadu a Ministerstva zemědělství, lesnictví a potravin (veřejné informace o Slovinsku).' + contributors_es_html: 'Å panělsko: Obsahuje data od Å¡panělského + Národního geografického institutu (IGN + a Národního kartografického systému (SCNE), + licencovaná pod CC + BY 4.0.' contributors_za_html: |- Jihoafrická republika: Obsahuje data pocházející z Chief Directorate: National Geo-Spatial Information, State copyright reserved. contributors_gb_html: 'Spojené království: Obsahuje data - Ordnance Survey © Crown copyright a právo k databázi 2010–12.' + Ordnance Survey © Crown copyright a právo k databázi 2010–19.' contributors_footer_1_html: |- Další podrobnosti o těchto a dalších zdrojích, které se používaly pro vylepÅ¡ení OpenStreetMap, najdete na stránce Contributors na wiki OpenStreetMap. diff --git a/config/locales/es.yml b/config/locales/es.yml index a4b4c514a..fd8d199f3 100644 --- a/config/locales/es.yml +++ b/config/locales/es.yml @@ -1493,7 +1493,7 @@ es: Surveying and Mapping Authority y Ministry of Agriculture, Forestry and Food (información pública de Eslovenia). - contributors_es_html: 'España: Contiene datos provenientes + contributors_es_html: 'España: Contiene datos provenientes del Instituto Geográfico Nacional (IGN) y del Sistema Cartográfico Nacional (SCNE), licenciados para su reutilización bajo la CC diff --git a/config/locales/fa.yml b/config/locales/fa.yml index dcdb2f180..b8746f146 100644 --- a/config/locales/fa.yml +++ b/config/locales/fa.yml @@ -1315,7 +1315,7 @@ fa: about: next: بعدی copyright_html: ©Ù…شارکت‌کنندگان
OpenStreetMap - used_by: صدها وبسایت، برنامهٔ موبایل و دستگاه سخت‌افزاری از داده‌های نقشهٔ %{name} + used_by: صدها وبسایت، برنامهٔ موبایل و دستگاه سخت‌افزاری از داده‌های %{name} نیرو گرفته‌اند. lede_text: OpenStreetMap را جامعه‌ای از نقشه‌کشان ساخته‌اند که در ایجاد و نگهداری داده‌های مربوط به جاده‌ها، مسیرهای تریل، کافه‌ها، ایستگاه‌های راه‌آهن و بسیاری diff --git a/config/locales/fr.yml b/config/locales/fr.yml index 49a189242..e6ecb9d12 100644 --- a/config/locales/fr.yml +++ b/config/locales/fr.yml @@ -1518,8 +1518,8 @@ fr: Afrique du Sud : contient des données issues de la Direction principale des Informations Géospatiales Nationales, copyright de l’État réservé. contributors_gb_html: 'Royaume-Uni : contient des données - issues de l’Ordnance Survey © 2010-2019 Droits d’auteurs et de - la base de données de la Couronne.' + issues de l’Ordnance Survey © 2010-2019 Droits d’auteurs et + de la base de données de la Couronne.' contributors_footer_1_html: Pour plus de détails sur celles-ci et sur les autres sources utilisées pour aider à améliorer OpenStreetMap, consultez la page des contributeurs diff --git a/config/locales/ja.yml b/config/locales/ja.yml index 6734c3b32..f0f5ee6e7 100644 --- a/config/locales/ja.yml +++ b/config/locales/ja.yml @@ -1374,8 +1374,8 @@ ja: href="http://www.mkgp.gov.si/en/">農林食料省(スロベニアの公開情報)による。' contributors_za_html: '南アフリカ: Chief Directorate: National Geo-Spatial Information,政府によるデータを含み、著作権を保持します。' - contributors_gb_html: 'イギリス: 陸地測量データ ©è‘—作権はクラウン・コピーライト及びdatabase - right 2010-12 を含みます。' + contributors_gb_html: "イギリス: 陸地測量\nデータ © クラウン・コピーライト及びデータベース権限 + database right \n2010-19 を含みます。" contributors_footer_1_html: |- これらの詳細について、またOpenStreetMapの向上に使用されたその他のソースについては、OpenStreetMap Wikiの協力者ページをご覧ください。 diff --git a/config/locales/pt-BR.yml b/config/locales/pt-BR.yml index a3eec4bd6..5d88661f4 100644 --- a/config/locales/pt-BR.yml +++ b/config/locales/pt-BR.yml @@ -1503,9 +1503,8 @@ pt-BR: Africa do Sul: contém dados originários de Chief Directorate: National Geo-Spatial Information, com direitos autorais reservados àquele Estado. - contributors_gb_html: |- - Reino Unido: Contém dados da Ordnance - Survey © Direitos da base e autorais da Crown 2010. + contributors_gb_html: 'Reino Unido: Contém dados do Ordnance + Survey © Crown copyright and database right 2010-2019.' contributors_footer_1_html: Para mais informações sobre estas e outras fontes utilizadas para melhorar o OpenStreetMap, consulte a página de contribuidores (em inglês) na wiki do OpenStreetMap.