Make sure all pages using the map layout call require_oauth

[rails.git] / app / controllers / relation_controller.rb

diff --git a/app/controllers/relation_controller.rb b/app/controllers/relation_controller.rb
index db68847e54a274819d2d5dc9e0c8ab8e99d72e71..9e7466a4ad4f7506b5d165e4584e33aa5424ff87 100644 (file)
--- a/app/controllers/relation_controller.rb
+++ b/app/controllers/relation_controller.rb
@@ -1,6 +1,7 @@
 class RelationController < ApplicationController
   require 'xml/libxml'
 
+  skip_before_filter :verify_authenticity_token
   before_filter :authorize, :only => [:create, :update, :delete]
   before_filter :require_allow_write_api, :only => [:create, :update, :delete]
   before_filter :require_public_data, :only => [:create, :update, :delete]
@@ -26,7 +27,7 @@ class RelationController < ApplicationController
 
   def read
     relation = Relation.find(params[:id])
-    response.headers['Last-Modified'] = relation.timestamp.rfc822
+    response.last_modified = relation.timestamp
     if relation.visible
       render :text => relation.to_xml.to_s, :content_type => "text/xml"
     else
@@ -44,7 +45,7 @@ class RelationController < ApplicationController
       relation.update_from new_relation, @user
       render :text => relation.version.to_s, :content_type => "text/plain"
     else
-      render :nothing => true, :status => :bad_request
+      render :text => "", :status => :bad_request
     end
   end
 
@@ -55,7 +56,7 @@ class RelationController < ApplicationController
       relation.delete_with_history!(new_relation, @user)
       render :text => relation.version.to_s, :content_type => "text/plain"
     else
-      render :nothing => true, :status => :bad_request
+      render :text => "", :status => :bad_request
     end
   end
 
@@ -124,24 +125,28 @@ class RelationController < ApplicationController
       render :text => doc.to_s, :content_type => "text/xml"
       
     else
-      render :nothing => true, :status => :gone
+      render :text => "", :status => :gone
     end
   end
 
   def relations
+    if not params['relations']
+      raise OSM::APIBadUserInput.new("The parameter relations is required, and must be of the form relations=id[,id[,id...]]")
+    end
+
     ids = params['relations'].split(',').collect { |w| w.to_i }
 
-    if ids.length > 0
-      doc = OSM::API.new.get_xml_doc
+    if ids.length == 0
+      raise OSM::APIBadUserInput.new("No relations were given to search for")
+    end
 
-      Relation.find(ids).each do |relation|
-        doc.root << relation.to_xml_node
-      end
+    doc = OSM::API.new.get_xml_doc
 
-      render :text => doc.to_s, :content_type => "text/xml"
-    else
-      render :text => "You need to supply a comma separated list of ids.", :status => :bad_request
+    Relation.find(ids).each do |relation|
+      doc.root << relation.to_xml_node
     end
+
+    render :text => doc.to_s, :content_type => "text/xml"
   end
 
   def relations_for_way
@@ -157,7 +162,7 @@ class RelationController < ApplicationController
   end
 
   def relations_for_object(objtype)
-    relationids = RelationMember.where(:member_type => objtype, :member_id => params[:id]).collect { |ws| ws.id[0] }.uniq
+    relationids = RelationMember.where(:member_type => objtype, :member_id => params[:id]).collect { |ws| ws.relation_id }.uniq
 
     doc = OSM::API.new.get_xml_doc