+ rescue ActionView::Template::Error => ex
+ ex = ex.cause
+
+ if ex.is_a?(Timeout::Error) ||
+ (ex.is_a?(ActiveRecord::StatementInvalid) && ex.message =~ /execution expired/)
+ render :action => "timeout"
+ else
+ raise
+ end
+ rescue Timeout::Error
+ render :action => "timeout"
+ end
+
+ ##
+ # ensure that there is a "user" instance variable
+ def lookup_user
+ render_unknown_user params[:display_name] unless @user = User.active.find_by(:display_name => params[:display_name])
+ end
+
+ ##
+ # render a "no such user" page
+ def render_unknown_user(name)
+ @title = t "users.no_such_user.title"
+ @not_found_user = name
+
+ respond_to do |format|
+ format.html { render :template => "users/no_such_user", :status => :not_found }
+ format.all { head :not_found }
+ end
+ end
+
+ ##
+ # Unfortunately if a PUT or POST request that has a body fails to
+ # read it then Apache will sometimes fail to return the response it
+ # is given to the client properly, instead erroring:
+ #
+ # https://issues.apache.org/bugzilla/show_bug.cgi?id=44782
+ #
+ # To work round this we call rewind on the body here, which is added
+ # as a filter, to force it to be fetched from Apache into a file.
+ def fetch_body
+ request.body.rewind
+ end
+
+ def map_layout
+ append_content_security_policy_directives(
+ :child_src => %w[http://127.0.0.1:8111 https://127.0.0.1:8112],
+ :frame_src => %w[http://127.0.0.1:8111 https://127.0.0.1:8112],
+ :connect_src => [NOMINATIM_URL, OVERPASS_URL, OSRM_URL, GRAPHHOPPER_URL],
+ :form_action => %w[render.openstreetmap.org],
+ :style_src => %w['unsafe-inline'],
+ :script_src => [MAPQUEST_DIRECTIONS_URL],
+ :img_src => %w[developer.mapquest.com]
+ )
+
+ if STATUS == :database_offline || STATUS == :api_offline
+ flash.now[:warning] = t("layouts.osm_offline")
+ elsif STATUS == :database_readonly || STATUS == :api_readonly
+ flash.now[:warning] = t("layouts.osm_read_only")
+ end
+
+ request.xhr? ? "xhr" : "map"
+ end
+
+ def allow_thirdparty_images
+ append_content_security_policy_directives(:img_src => %w[*])
+ end
+
+ def preferred_editor
+ editor = if params[:editor]
+ params[:editor]
+ elsif current_user&.preferred_editor
+ current_user.preferred_editor
+ else
+ DEFAULT_EDITOR
+ end
+
+ editor
+ end
+
+ helper_method :preferred_editor
+
+ def update_totp
+ if defined?(TOTP_KEY)
+ cookies["_osm_totp_token"] = {
+ :value => ROTP::TOTP.new(TOTP_KEY, :interval => 3600).now,
+ :domain => "openstreetmap.org",
+ :expires => 1.hour.from_now
+ }
+ end
+ end
+
+ def better_errors_allow_inline
+ yield
+ rescue StandardError
+ append_content_security_policy_directives(
+ :script_src => %w['unsafe-inline'],
+ :style_src => %w['unsafe-inline']
+ )
+
+ raise
+ end
+
+ def current_ability
+ # Use capabilities from the oauth token if it exists and is a valid access token
+ if Authenticator.new(self, [:token]).allow?
+ Ability.new(nil).merge(Capability.new(current_token))
+ else
+ Ability.new(current_user)
+ end
+ end
+
+ def deny_access(exception)
+ if @api_deny_access_handling
+ api_deny_access(exception)
+ else
+ web_deny_access(exception)
+ end
projects / rails.git / blobdiff