Ooops. Added missing access control to changeset controller.

[rails.git] / app / controllers / changeset_controller.rb

diff --git a/app/controllers/changeset_controller.rb b/app/controllers/changeset_controller.rb
index c56e15c0186a74d2f66ea28075da65710c4ca0a5..9152df81671525f3b4f84409b76fb9c75d78cb33 100644 (file)
--- a/app/controllers/changeset_controller.rb
+++ b/app/controllers/changeset_controller.rb
@@ -41,7 +41,13 @@ class ChangesetController < ApplicationController
         render :nothing => true, :status => :method_not_allowed
         return
       end
         render :nothing => true, :status => :method_not_allowed
         return
       end

+

       changeset = Changeset.find(params[:id])
       changeset = Changeset.find(params[:id])

+
+      unless @user.id == changeset.user_id 
+        raise OSM::APIUserChangesetMismatchError 
+      end
+

       changeset.open = false
       changeset.save!
       render :nothing => true
       changeset.open = false
       changeset.save!
       render :nothing => true


@@ -61,6 +67,12 @@ class ChangesetController < ApplicationController
     if request.post?
       cs = Changeset.find(params[:id])
 
     if request.post?
       cs = Changeset.find(params[:id])
 

+      # check user credentials - only the user who opened a changeset
+      # may alter it.
+      unless @user.id == changeset.user_id 
+        raise OSM::APIUserChangesetMismatchError 
+      end
+

       # keep an array of lons and lats
       lon = Array.new
       lat = Array.new
       # keep an array of lons and lats
       lon = Array.new
       lat = Array.new


@@ -120,6 +132,12 @@ class ChangesetController < ApplicationController
       return
     end
 
       return
     end
 

+    # access control - only the user who created a changeset may
+    # upload to it.
+    unless @user.id == changeset.user_id 
+      raise OSM::APIUserChangesetMismatchError 
+    end
+

     changeset = Changeset.find(params[:id])
     
     diff_reader = DiffReader.new(request.raw_post, changeset)
     changeset = Changeset.find(params[:id])
     
     diff_reader = DiffReader.new(request.raw_post, changeset)