Prevent CSRF bypass with login form

[rails.git] / app / views / browse / note.html.erb

diff --git a/app/views/browse/note.html.erb b/app/views/browse/note.html.erb
index a3b5f0c544d8dd72de78be5d93ad3890128171d0..1a792e873952ce3dc98b5d6b7ced79e6f27cdeb2 100644 (file)
--- a/app/views/browse/note.html.erb
+++ b/app/views/browse/note.html.erb
@@ -1,39 +1,43 @@
-<% set_title(t('browse.note.title', :id => @note.id)) %>
+<% set_title(t(".title", :id => @note.id)) %>

 
 

-<h2>
-  <a class="geolink" href="<%= root_path %>"><span class="icon close"></span></a>
-  <%= t "browse.note.#{@note.status}_title", :note_name => @note.id %>
-  <% if @user && @note.author && @user.id != @note.author.id %>
-    <%= link_to new_issue_url(reportable_id: @note.id, reportable_type: @note.class.name, reported_user_id: @note.author.id,referer: request.fullpath), :title => t('browse.note.report') do %>
-        &nbsp;&#9872;
-    <% end %>
-  <% end %>
-</h2>
+<%= render "sidebar_header", :title => t(".#{@note.status}_title", :note_name => @note.id) %>

 
 <div class="browse-section">
 
 <div class="browse-section">

-  <h4><%= t('browse.note.description') %></h4>
+  <h4><%= t(".description") %></h4>

   <div class="note-description">
     <%= h(@note_comments.first.body.to_html) %>
   </div>
 
   <div class="details" data-coordinates="<%= @note.lat %>,<%= @note.lon %>" data-status="<%= @note.status %>">
   <div class="note-description">
     <%= h(@note_comments.first.body.to_html) %>
   </div>
 
   <div class="details" data-coordinates="<%= @note.lat %>,<%= @note.lon %>" data-status="<%= @note.status %>">

-    <%= note_event('open', @note.created_at, @note.author) %>
-    <% if @note.status == "closed" %>
-      <br/>
-      <%= note_event(@note.status, @note.closed_at, @note_comments.last.author) %>
-    <% end %>
+    <ul class="list-unstyled">
+      <li><%= note_event("opened", @note.created_at, @note.author) %></li>
+      <% if @note.status == "closed" %>
+        <li><%= note_event(@note.status, @note.closed_at, @note.all_comments.last.author) %></li>
+      <% end %>
+      <li>
+        <%= t "browse.location" %>
+        <%= link_to(t(".coordinates_html",
+                      :latitude => tag.span(number_with_delimiter(@note.lat), :class => "latitude"),
+                      :longitude => tag.span(number_with_delimiter(@note.lon), :class => "longitude")),
+                    root_path(:anchor => "map=18/#{@note.lat}/#{@note.lon}")) %>
+      </li>
+    </ul>

   </div>
 
   <% if @note_comments.find { |comment| comment.author.nil? } -%>
   </div>
 
   <% if @note_comments.find { |comment| comment.author.nil? } -%>

-    <p class='warning'><%= t "javascripts.notes.show.anonymous_warning" %></p>
+    <p class='alert alert-warning'><%= t "javascripts.notes.show.anonymous_warning" %></p>

   <% end -%>
 
   <% end -%>
 

+  <% if current_user && current_user != @note.author %>
+    <p class="text-muted"><%= report_link(t(".report"), @note) %></p>
+  <% end %>
+

   <% if @note_comments.length > 1 %>
     <div class='note-comments'>
   <% if @note_comments.length > 1 %>
     <div class='note-comments'>

-      <ul>
-        <% @note_comments[1..-1].each do |comment| %>
+      <ul class="list-unstyled">
+        <% @note_comments.drop(1).each do |comment| %>

           <li id="c<%= comment.id %>">
           <li id="c<%= comment.id %>">

-            <small class='deemphasize'><%= note_event(comment.event, comment.created_at, comment.author) %></small>
+            <small class='text-muted'><%= note_event(comment.event, comment.created_at, comment.author) %></small>

             <%= comment.body.to_html %>
           </li>
         <% end %>
             <%= comment.body.to_html %>
           </li>
         <% end %>


@@ -42,20 +46,30 @@
   <% end %>
 
   <% if @note.status == "open" %>
   <% end %>
 
   <% if @note.status == "open" %>

-    <form action="#">
-      <textarea class="comment" name="text" cols="40" rows="5"></textarea>
-      <div class="buttons clearfix">
-        <input type="submit" name="hide" value="<%= t('javascripts.notes.show.hide') %>" class="hide_unless_moderator deemphasize" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, 'json') %>">
-        <input type="submit" name="close" value="<%= t('javascripts.notes.show.resolve') %>" class="hide_unless_logged_in" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= close_note_url(@note, 'json') %>">
-        <input type="submit" name="comment" value="<%= t('javascripts.notes.show.comment') %>" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= comment_note_url(@note, 'json') %>" disabled="1">
-      </div>
-    </form>
+    <% if current_user -%>
+      <form action="#">
+        <div class="form-group">
+          <textarea class="form-control" name="text" cols="40" rows="5" maxlength="2000"></textarea>
+        </div>
+        <div>
+          <% if current_user.moderator? -%>
+            <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+          <% end -%>
+          <input type="submit" name="close" value="<%= t("javascripts.notes.show.resolve") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= close_note_url(@note, "json") %>">
+          <input type="submit" name="comment" value="<%= t("javascripts.notes.show.comment") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= comment_note_url(@note, "json") %>" disabled="1">
+        </div>
+      </form>
+    <% end -%>

   <% else %>
     <form action="#">
       <input type="hidden" name="text" value="">
   <% else %>
     <form action="#">
       <input type="hidden" name="text" value="">

-      <div class="buttons clearfix">
-        <input type="submit" name="hide" value="<%= t('javascripts.notes.show.hide') %>" class="hide_unless_moderator deemphasize" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, 'json') %>">
-        <input type="submit" name="reopen" value="<%= t('javascripts.notes.show.reactivate') %>" class="hide_unless_logged_in" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= reopen_note_url(@note, 'json') %>">
+      <div>
+        <% if current_user and current_user.moderator? -%>
+          <input type="submit" name="hide" value="<%= t("javascripts.notes.show.hide") %>" class="btn btn-light" data-note-id="<%= @note.id %>" data-method="DELETE" data-url="<%= note_url(@note, "json") %>">
+        <% end -%>
+        <% if current_user -%>
+          <input type="submit" name="reopen" value="<%= t("javascripts.notes.show.reactivate") %>" class="btn btn-primary" data-note-id="<%= @note.id %>" data-method="POST" data-url="<%= reopen_note_url(@note, "json") %>">
+        <% end -%>

       </div>
     </form>
   <% end %>
       </div>
     </form>
   <% end %>