Make safe_referer handle invalid URIs

[rails.git] / app / models / changeset.rb

diff --git a/app/models/changeset.rb b/app/models/changeset.rb
index 2001c70be8f7c95950495dd3d33e98b007b360c3..aa674ea7fc5391ec781119e20f07d5bcef478332 100644 (file)
--- a/app/models/changeset.rb
+++ b/app/models/changeset.rb
@@ -1,5 +1,32 @@
-class Changeset < ActiveRecord::Base
-  require 'xml/libxml'
+# == Schema Information
+#
+# Table name: changesets
+#
+#  id          :bigint(8)        not null, primary key
+#  user_id     :bigint(8)        not null
+#  created_at  :datetime         not null
+#  min_lat     :integer
+#  max_lat     :integer
+#  min_lon     :integer
+#  max_lon     :integer
+#  closed_at   :datetime         not null
+#  num_changes :integer          default(0), not null
+#
+# Indexes
+#
+#  changesets_bbox_idx                (min_lat,max_lat,min_lon,max_lon) USING gist
+#  changesets_closed_at_idx           (closed_at)
+#  changesets_created_at_idx          (created_at)
+#  changesets_user_id_created_at_idx  (user_id,created_at)
+#  changesets_user_id_id_idx          (user_id,id)
+#
+# Foreign Keys
+#
+#  changesets_user_id_fkey  (user_id => users.id)
+#
+
+class Changeset < ApplicationRecord
+  require "xml/libxml"

 
   belongs_to :user, :counter_cache => true
 
 
   belongs_to :user, :counter_cache => true
 


@@ -13,23 +40,23 @@ class Changeset < ActiveRecord::Base
   has_many :old_relations
 
   has_many :comments, -> { where(:visible => true).order(:created_at) }, :class_name => "ChangesetComment"
   has_many :old_relations
 
   has_many :comments, -> { where(:visible => true).order(:created_at) }, :class_name => "ChangesetComment"

-  has_and_belongs_to_many :subscribers, :class_name => 'User', :join_table => 'changesets_subscribers', :association_foreign_key => 'subscriber_id'
-
-  validates_presence_of :id, :on => :update
-  validates_presence_of :user_id, :created_at, :closed_at, :num_changes
-  validates_uniqueness_of :id
-  validates_numericality_of :id, :on => :update, :integer_only => true
-  validates_numericality_of :min_lat, :max_lat, :min_lon, :max_lat, :allow_nil => true, :integer_only => true
-  validates_numericality_of :user_id,  :integer_only => true
-  validates_numericality_of :num_changes, :integer_only => true, :greater_than_or_equal_to => 0
+  has_and_belongs_to_many :subscribers, :class_name => "User", :join_table => "changesets_subscribers", :association_foreign_key => "subscriber_id"
+
+  validates :id, :uniqueness => true, :presence => { :on => :update },
+                 :numericality => { :on => :update, :only_integer => true }
+  validates :user_id, :presence => true,
+                      :numericality => { :only_integer => true }
+  validates :num_changes, :presence => true,
+                          :numericality => { :only_integer => true,
+                                             :greater_than_or_equal_to => 0 }
+  validates :created_at, :closed_at, :presence => true
+  validates :min_lat, :max_lat, :min_lon, :max_lat, :allow_nil => true,
+                                                    :numericality => { :only_integer => true }

 
   before_save :update_closed_at
 
 
   before_save :update_closed_at
 

-  # over-expansion factor to use when updating the bounding box
-  EXPAND = 0.1
-

   # maximum number of elements allowed in a changeset
   # maximum number of elements allowed in a changeset

-  MAX_ELEMENTS = 50000
+  MAX_ELEMENTS = 10000

 
   # maximum time a changeset is allowed to be open for.
   MAX_TIME_OPEN = 1.day
 
   # maximum time a changeset is allowed to be open for.
   MAX_TIME_OPEN = 1.day


@@ -50,24 +77,24 @@ class Changeset < ActiveRecord::Base
   end
 
   def set_closed_time_now
   end
 
   def set_closed_time_now

-    if is_open?
-      self.closed_at = Time.now.getutc
-    end
+    self.closed_at = Time.now.getutc if is_open?

   end
 
   end
 

-  def self.from_xml(xml, create = false)
+  def self.from_xml(xml, create: false)

     p = XML::Parser.string(xml, :options => XML::Parser::Options::NOERROR)
     doc = p.parse
     p = XML::Parser.string(xml, :options => XML::Parser::Options::NOERROR)
     doc = p.parse

+    pt = doc.find_first("//osm/changeset")

 
 

-    doc.find('//osm/changeset').each do |pt|
-      return Changeset.from_xml_node(pt, create)
+    if pt
+      Changeset.from_xml_node(pt, :create => create)
+    else
+      raise OSM::APIBadXMLError.new("changeset", xml, "XML doesn't contain an osm/changeset element.")

     end
     end

-    fail OSM::APIBadXMLError.new("changeset", xml, "XML doesn't contain an osm/changeset element.")
-  rescue LibXML::XML::Error, ArgumentError => ex
-    raise OSM::APIBadXMLError.new("changeset", xml, ex.message)
+  rescue LibXML::XML::Error, ArgumentError => e
+    raise OSM::APIBadXMLError.new("changeset", xml, e.message)

   end
 
   end
 

-  def self.from_xml_node(pt, create = false)
+  def self.from_xml_node(pt, create: false)

     cs = Changeset.new
     if create
       cs.created_at = Time.now.getutc
     cs = Changeset.new
     if create
       cs.created_at = Time.now.getutc


@@ -78,10 +105,11 @@ class Changeset < ActiveRecord::Base
       cs.num_changes = 0
     end
 
       cs.num_changes = 0
     end
 

-    pt.find('tag').each do |tag|
-      fail OSM::APIBadXMLError.new("changeset", pt, "tag is missing key") if tag['k'].nil?
-      fail OSM::APIBadXMLError.new("changeset", pt, "tag is missing value") if tag['v'].nil?
-      cs.add_tag_keyval(tag['k'], tag['v'])
+    pt.find("tag").each do |tag|
+      raise OSM::APIBadXMLError.new("changeset", pt, "tag is missing key") if tag["k"].nil?
+      raise OSM::APIBadXMLError.new("changeset", pt, "tag is missing value") if tag["v"].nil?
+
+      cs.add_tag_keyval(tag["k"], tag["v"])

     end
 
     cs
     end
 
     cs


@@ -99,30 +127,22 @@ class Changeset < ActiveRecord::Base
   end
 
   ##
   end
 
   ##

-  # expand the bounding box to include the given bounding box. also,
-  # expand a little bit more in the direction of the expansion, so that
-  # further expansions may be unnecessary. this is an optimisation
-  # suggested on the wiki page by kleptog.
+  # expand the bounding box to include the given bounding box.

   def update_bbox!(bbox_update)
   def update_bbox!(bbox_update)

-    bbox.expand!(bbox_update, EXPAND)
+    bbox.expand!(bbox_update)

 
     # update active record. rails 2.1's dirty handling should take care of
     # whether this object needs saving or not.
 
     # update active record. rails 2.1's dirty handling should take care of
     # whether this object needs saving or not.

-    self.min_lon, self.min_lat, self.max_lon, self.max_lat = @bbox.to_a if bbox.complete?
+    self.min_lon, self.min_lat, self.max_lon, self.max_lat = @bbox.to_a.collect(&:round) if bbox.complete?

   end
 
   ##
   # the number of elements is also passed in so that we can ensure that
   end
 
   ##
   # the number of elements is also passed in so that we can ensure that

-  # a single changeset doesn't contain too many elements. this, of course,
-  # destroys the optimisation described in the bbox method above.
+  # a single changeset doesn't contain too many elements.

   def add_changes!(elements)
     self.num_changes += elements
   end
 
   def add_changes!(elements)
     self.num_changes += elements
   end
 

-  def tags_as_hash
-    tags
-  end
-

   def tags
     unless @tags
       @tags = {}
   def tags
     unless @tags
       @tags = {}


@@ -136,11 +156,11 @@ class Changeset < ActiveRecord::Base
   attr_writer :tags
 
   def add_tag_keyval(k, v)
   attr_writer :tags
 
   def add_tag_keyval(k, v)

-    @tags = {} unless @tags
+    @tags ||= {}

 
     # duplicate tags are now forbidden, so we can't allow values
     # in the hash to be overwritten.
 
     # duplicate tags are now forbidden, so we can't allow values
     # in the hash to be overwritten.

-    fail OSM::APIDuplicateTagsError.new("changeset", id, k) if @tags.include? k
+    raise OSM::APIDuplicateTagsError.new("changeset", id, k) if @tags.include? k

 
     @tags[k] = v
   end
 
     @tags[k] = v
   end


@@ -149,10 +169,10 @@ class Changeset < ActiveRecord::Base
     # do the changeset update and the changeset tags update in the
     # same transaction to ensure consistency.
     Changeset.transaction do
     # do the changeset update and the changeset tags update in the
     # same transaction to ensure consistency.
     Changeset.transaction do

-      self.save!
+      save!

 
       tags = self.tags
 
       tags = self.tags

-      ChangesetTag.delete_all(:changeset_id => id)
+      ChangesetTag.where(:changeset_id => id).delete_all

 
       tags.each do |k, v|
         tag = ChangesetTag.new
 
       tags.each do |k, v|
         tag = ChangesetTag.new


@@ -169,75 +189,13 @@ class Changeset < ActiveRecord::Base
   # that would make it more than 24h long, in which case clip to
   # 24h, as this has been decided is a reasonable time limit.
   def update_closed_at
   # that would make it more than 24h long, in which case clip to
   # 24h, as this has been decided is a reasonable time limit.
   def update_closed_at

-    if self.is_open?
-      if (closed_at - created_at) > (MAX_TIME_OPEN - IDLE_TIMEOUT)
-        self.closed_at = created_at + MAX_TIME_OPEN
-      else
-        self.closed_at = Time.now.getutc + IDLE_TIMEOUT
-      end
-    end
-  end
-
-  def to_xml(include_discussion = false)
-    doc = OSM::API.new.get_xml_doc
-    doc.root << to_xml_node(nil, include_discussion)
-    doc
-  end
-
-  def to_xml_node(user_display_name_cache = nil, include_discussion = false)
-    el1 = XML::Node.new 'changeset'
-    el1['id'] = id.to_s
-
-    user_display_name_cache = {} if user_display_name_cache.nil?
-
-    if user_display_name_cache && user_display_name_cache.key?(user_id)
-      # use the cache if available
-    elsif user.data_public?
-      user_display_name_cache[user_id] = user.display_name
-    else
-      user_display_name_cache[user_id] = nil
-    end
-
-    el1['user'] = user_display_name_cache[user_id] unless user_display_name_cache[user_id].nil?
-    el1['uid'] = user_id.to_s if user.data_public?
-
-    tags.each do |k, v|
-      el2 = XML::Node.new('tag')
-      el2['k'] = k.to_s
-      el2['v'] = v.to_s
-      el1 << el2
-    end
-
-    el1['created_at'] = created_at.xmlschema
-    el1['closed_at'] = closed_at.xmlschema unless is_open?
-    el1['open'] = is_open?.to_s
-
-    if bbox.complete?
-      bbox.to_unscaled.add_bounds_to(el1, '_')
-    end
-
-    el1['comments_count'] = comments.count.to_s
-
-    if include_discussion
-      el2 = XML::Node.new('discussion')
-      comments.includes(:author).each do |comment|
-        el3 = XML::Node.new('comment')
-        el3['date'] = comment.created_at.xmlschema
-        el3['uid'] = comment.author.id.to_s if comment.author.data_public?
-        el3['user'] = comment.author.display_name.to_s if comment.author.data_public?
-        el4 = XML::Node.new('text')
-        el4.content = comment.body.to_s
-        el3 << el4
-        el2 << el3
-      end
-      el1 << el2
+    if is_open?
+      self.closed_at = if (closed_at - created_at) > (MAX_TIME_OPEN - IDLE_TIMEOUT)
+                         created_at + MAX_TIME_OPEN
+                       else
+                         Time.now.getutc + IDLE_TIMEOUT
+                       end

     end
     end

-
-    # NOTE: changesets don't include the XML of the changes within them,
-    # they are just structures for tagging. to get the osmChange of a
-    # changeset, see the download method of the controller.
-
-    el1

   end
 
   ##
   end
 
   ##


@@ -246,14 +204,10 @@ class Changeset < ActiveRecord::Base
   # bounding box, only the tags of the changeset.
   def update_from(other, user)
     # ensure that only the user who opened the changeset may modify it.
   # bounding box, only the tags of the changeset.
   def update_from(other, user)
     # ensure that only the user who opened the changeset may modify it.

-    unless user.id == user_id
-      fail OSM::APIUserChangesetMismatchError.new
-    end
+    raise OSM::APIUserChangesetMismatchError unless user.id == user_id

 
     # can't change a closed changeset
 
     # can't change a closed changeset

-    unless is_open?
-      fail OSM::APIChangesetAlreadyClosedError.new(self)
-    end
+    raise OSM::APIChangesetAlreadyClosedError, self unless is_open?

 
     # copy the other's tags
     self.tags = other.tags
 
     # copy the other's tags
     self.tags = other.tags