1 class UserController < ApplicationController
2 layout 'site', :except => :api_details
4 before_filter :authorize, :only => [:api_details, :api_gpx_files]
5 before_filter :authorize_web, :except => [:api_details, :api_gpx_files]
6 before_filter :set_locale, :except => [:api_details, :api_gpx_files]
7 before_filter :require_user, :only => [:account, :go_public, :make_friend, :remove_friend]
8 before_filter :check_database_readable, :except => [:api_details, :api_gpx_files]
9 before_filter :check_database_writable, :only => [:login, :new, :account, :go_public, :make_friend, :remove_friend]
10 before_filter :check_api_readable, :only => [:api_details, :api_gpx_files]
11 before_filter :require_allow_read_prefs, :only => [:api_details]
12 before_filter :require_allow_read_gpx, :only => [:api_gpx_files]
13 before_filter :require_cookies, :only => [:login, :confirm]
14 before_filter :require_administrator, :only => [:set_status, :delete, :list]
15 before_filter :lookup_this_user, :only => [:set_status, :delete]
17 filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
19 cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete], :unless => STATUS == :database_offline
22 @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE
23 @text = OSM.legal_text_for_country(@legale)
26 render :update do |page|
27 page.replace_html "contributorTerms", :partial => "terms", :locals => { :has_decline => params[:has_decline] }
30 @title = t 'user.terms.title'
31 @user = User.new(params[:user]) if params[:user]
35 render :action => :new
36 elsif @user.terms_agreed?
37 redirect_to :action => :account, :display_name => @user.display_name
40 redirect_to :action => :login, :referer => request.request_uri
46 @title = t 'user.new.title'
48 if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"})
49 render :action => 'new'
50 elsif params[:decline]
51 redirect_to t('user.terms.declined')
53 if !@user.terms_agreed?
54 @user.consider_pd = params[:user][:consider_pd]
55 @user.terms_agreed = Time.now.getutc
57 flash[:notice] = t 'user.new.terms accepted'
61 redirect_to :action => :account, :display_name => @user.display_name
63 @user = User.new(params[:user])
65 @user.status = "pending"
66 @user.data_public = true
67 @user.description = "" if @user.description.nil?
68 @user.creation_ip = request.remote_ip
69 @user.languages = request.user_preferred_languages
70 @user.terms_agreed = Time.now.getutc
73 flash[:notice] = t 'user.new.flash create success message', :email => @user.email
74 Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => params[:referer]))
75 redirect_to :action => 'login'
77 render :action => 'new'
83 @title = t 'user.account.title'
84 @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null'
86 if params[:user] and params[:user][:display_name] and params[:user][:description]
87 @user.display_name = params[:user][:display_name]
88 @user.new_email = params[:user][:new_email]
90 if params[:user][:pass_crypt].length > 0 or params[:user][:pass_crypt_confirmation].length > 0
91 @user.pass_crypt = params[:user][:pass_crypt]
92 @user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]
95 @user.description = params[:user][:description]
96 @user.languages = params[:user][:languages].split(",")
98 case params[:image_action]
99 when "new" then @user.image = params[:user][:image]
100 when "delete" then @user.image = nil
103 @user.home_lat = params[:user][:home_lat]
104 @user.home_lon = params[:user][:home_lon]
109 if @user.new_email.nil? or @user.new_email.empty?
110 flash[:notice] = t 'user.account.flash update success'
112 flash[:notice] = t 'user.account.flash update success confirm needed'
115 Notifier.deliver_email_confirm(@user, @user.tokens.create)
117 # Ignore errors sending email
121 redirect_to :action => "account", :display_name => @user.display_name
125 flash[:errors].each do |attr,msg|
126 attr = "new_email" if attr == "email"
127 @user.errors.add(attr,msg)
134 @user.data_public = true
136 flash[:notice] = t 'user.go_public.flash success'
137 redirect_to :controller => 'user', :action => 'account', :display_name => @user.display_name
141 @title = t 'user.lost_password.title'
143 if params[:user] and params[:user][:email]
144 user = User.find_by_email(params[:user][:email], :conditions => {:status => ["pending", "active", "confirmed"]})
147 token = user.tokens.create
148 Notifier.deliver_lost_password(user, token)
149 flash[:notice] = t 'user.lost_password.notice email on way'
150 redirect_to :action => 'login'
152 flash.now[:error] = t 'user.lost_password.notice email cannot find'
158 @title = t 'user.reset_password.title'
161 token = UserToken.find_by_token(params[:token])
167 @user.pass_crypt = params[:user][:pass_crypt]
168 @user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]
169 @user.status = "active" if @user.status == "pending"
170 @user.email_valid = true
174 flash[:notice] = t 'user.reset_password.flash changed'
175 redirect_to :action => 'login'
179 flash[:error] = t 'user.reset_password.flash token bad'
180 redirect_to :action => 'lost_password'
186 @title = t 'user.new.title'
188 # The user is logged in already, so don't show them the signup
189 # page, instead send them to the home page
190 redirect_to :controller => 'site', :action => 'index' if session[:user]
194 @title = t 'user.login.title'
197 email_or_display_name = params[:user][:email]
198 pass = params[:user][:password]
199 user = User.authenticate(:username => email_or_display_name, :password => pass)
202 session[:user] = user.id
203 session_expires_after 1.month if params[:remember_me]
205 # The user is logged in, if the referer param exists, redirect
206 # them to that unless they've also got a block on them, in
207 # which case redirect them to the block so they can clear it.
208 if user.blocked_on_view
209 redirect_to user.blocked_on_view, :referer => params[:referer]
210 elsif params[:referer]
211 redirect_to params[:referer]
213 redirect_to :controller => 'site', :action => 'index'
215 elsif user = User.authenticate(:username => email_or_display_name, :password => pass, :pending => true)
216 flash.now[:error] = t 'user.login.account not active', :reconfirm => url_for(:action => 'confirm_resend', :display_name => user.display_name)
217 elsif User.authenticate(:username => email_or_display_name, :password => pass, :suspended => true)
218 webmaster = link_to t('user.login.webmaster'), "mailto:webmaster@openstreetmap.org"
219 flash.now[:error] = t 'user.login.account suspended', :webmaster => webmaster
221 flash.now[:error] = t 'user.login.auth failure'
223 elsif flash[:notice].nil?
224 flash.now[:notice] = t 'user.login.notice'
229 @title = t 'user.logout.title'
231 if params[:session] == request.session_options[:id]
233 token = UserToken.find_by_token(session[:token])
237 session[:token] = nil
240 session_expires_automatically
242 redirect_to params[:referer]
244 redirect_to :controller => 'site', :action => 'index'
251 if token = UserToken.find_by_token(params[:confirm_string])
252 if token.user.active?
253 flash[:error] = t('user.confirm.already active')
254 redirect_to :action => 'login'
257 user.status = "active"
258 user.email_valid = true
260 referer = token.referer
262 session[:user] = user.id
265 flash[:notice] = t('user.confirm.success')
268 flash[:notice] = t('user.confirm.success') + "<br /><br />" + t('user.confirm.before you start')
269 redirect_to :action => 'account', :display_name => user.display_name
273 user = User.find_by_display_name(params[:display_name])
275 if user and user.active?
276 flash[:error] = t('user.confirm.already active')
278 flash[:error] = t('user.confirm.unknown token') + t('user.confirm.reconfirm', :reconfirm => url_for(:action => 'confirm_resend', :display_name => params[:display_name]))
280 flash[:error] = t('user.confirm.unknown token')
283 redirect_to :action => 'login'
289 if user = User.find_by_display_name(params[:display_name])
290 Notifier.deliver_signup_confirm(user, user.tokens.create)
291 flash[:notice] = t 'user.confirm_resend.success', :email => user.email
293 flash[:notice] = t 'user.confirm_resend.failure', :name => params[:display_name]
296 redirect_to :action => 'login'
301 token = UserToken.find_by_token(params[:confirm_string])
302 if token and token.user.new_email?
304 @user.email = @user.new_email
305 @user.new_email = nil
306 @user.email_valid = true
308 flash[:notice] = t 'user.confirm_email.success'
310 flash[:errors] = @user.errors
313 session[:user] = @user.id
314 redirect_to :action => 'account', :display_name => @user.display_name
316 flash[:error] = t 'user.confirm_email.failure'
317 redirect_to :action => 'account', :display_name => @user.display_name
323 doc = OSM::API.new.get_xml_doc
324 @user.traces.each do |trace|
325 doc.root << trace.to_xml_node() if trace.public? or trace.user == @user
327 render :text => doc.to_s, :content_type => "text/xml"
331 @this_user = User.find_by_display_name(params[:display_name])
334 (@this_user.visible? or (@user and @user.administrator?))
335 @title = @this_user.display_name
337 @title = t 'user.no_such_user.title'
338 @not_found_user = params[:display_name]
339 render :action => 'no_such_user', :status => :not_found
344 if params[:display_name]
345 name = params[:display_name]
346 new_friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]})
348 friend.user_id = @user.id
349 friend.friend_user_id = new_friend.id
350 unless @user.is_friends_with?(new_friend)
352 flash[:notice] = t 'user.make_friend.success', :name => name
353 Notifier.deliver_friend_notification(friend)
355 friend.add_error(t('user.make_friend.failed', :name => name))
358 flash[:warning] = t 'user.make_friend.already_a_friend', :name => name
362 redirect_to params[:referer]
364 redirect_to :controller => 'user', :action => 'view'
370 if params[:display_name]
371 name = params[:display_name]
372 friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]})
373 if @user.is_friends_with?(friend)
374 Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}"
375 flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name
377 flash[:error] = t 'user.remove_friend.not_a_friend', :name => friend.display_name
381 redirect_to params[:referer]
383 redirect_to :controller => 'user', :action => 'view'
389 # sets a user's status
391 @this_user.update_attributes(:status => params[:status])
392 redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
396 # delete a user, marking them as deleted and removing personal data
399 redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
403 # display a list of users matching specified criteria
406 ids = params[:user].keys.collect { |id| id.to_i }
408 User.update_all("status = 'confirmed'", :id => ids) if params[:confirm]
409 User.update_all("status = 'deleted'", :id => ids) if params[:hide]
411 redirect_to url_for(:status => params[:status], :ip => params[:ip], :page => params[:page])
413 conditions = Hash.new
414 conditions[:status] = params[:status] if params[:status]
415 conditions[:creation_ip] = params[:ip] if params[:ip]
417 @user_pages, @users = paginate(:users,
418 :conditions => conditions,
427 # require that the user is a administrator, or fill out a helpful error message
428 # and return them to the user page.
429 def require_administrator
430 if @user and not @user.administrator?
431 flash[:error] = t('user.filter.not_an_administrator')
433 if params[:display_name]
434 redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
436 redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri
439 redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri
444 # ensure that there is a "this_user" instance variable
446 @this_user = User.find_by_display_name(params[:display_name])
447 rescue ActiveRecord::RecordNotFound
448 redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] unless @this_user