Close a number of holes in the API by making it validate changes

[rails.git] / app / controllers / node_controller.rb

diff --git a/app/controllers/node_controller.rb b/app/controllers/node_controller.rb
index 27c21c4815a78fea0da3c0846ac8d72559ba82b1..f2a3ce3291cd48e2f7203d5457eb742fbb150a4e 100644 (file)
--- a/app/controllers/node_controller.rb
+++ b/app/controllers/node_controller.rb
@@ -5,21 +5,15 @@ class NodeController < ApplicationController
   after_filter :compress_output
 
   def create
-    response.headers["Content-Type"] = 'application/xml'
+    response.headers["Content-Type"] = 'text/xml'
     if request.put?
-      node = nil
-      begin
-        node = Node.from_xml(request.raw_post, true)
-      rescue
-        render :text => "XML didn't parse", :status => 400 # if we got here the doc didnt parse
-        return
-      end
+      node = Node.from_xml(request.raw_post, true)
 
       if node
         node.user_id = @user.id
         node.visible = 1
         if node.save_with_history
-          render :text => node.id
+          render :text => node.id.to_s
         else
           render :nothing => true, :status => 500
         end
@@ -35,7 +29,7 @@ class NodeController < ApplicationController
   end
 
   def rest
-    response.headers["Content-Type"] = 'application/xml'
+    response.headers["Content-Type"] = 'text/xml'
     unless Node.exists?(params[:id])
       render :nothing => true, :status => 404
       return
@@ -61,9 +55,13 @@ class NodeController < ApplicationController
 
     when :delete
       if node.visible
-        node.visible = 0
-        node.save_with_history
-        render :nothing => true
+        if Segment.find(:first, :conditions => [ "visible = 1 and (node_a = ? or node_b = ?)", node.id, node.id])
+          render :nothing => true, :status => HTTP_PRECONDITION_FAILED
+        else
+          node.visible = 0
+          node.save_with_history
+          render :nothing => true
+        end
       else
         render :nothing => true, :status => 410
       end
@@ -71,17 +69,21 @@ class NodeController < ApplicationController
     when :put
       new_node = Node.from_xml(request.raw_post)
 
-      node.timestamp = Time.now
-      node.user_id = @user.id
+      if new_node
+        node.timestamp = Time.now
+        node.user_id = @user.id
 
-      node.latitude = new_node.latitude 
-      node.longitude = new_node.longitude
-      node.tags = new_node.tags
+        node.latitude = new_node.latitude 
+        node.longitude = new_node.longitude
+        node.tags = new_node.tags
 
-      if node.id == new_node.id and node.save_with_history
-        render :nothing => true, :status => 200
+        if node.id == new_node.id and node.save_with_history
+          render :nothing => true
+        else
+          render :nothing => true, :status => 500
+        end
       else
-        render :nothing => true, :status => 500
+        render :nothing => true, :status => 400 # if we got here the doc didnt parse
       end
       return
     end
@@ -89,7 +91,7 @@ class NodeController < ApplicationController
   end
 
   def nodes
-    response.headers["Content-Type"] = 'application/xml'
+    response.headers["Content-Type"] = 'text/xml'
     ids = params['nodes'].split(',').collect {|n| n.to_i }
     if ids.length > 0
       nodelist = Node.find(ids)