X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/5620d7263a36fe842f4d97bc21dda5edd0651b37..6d7e69d4d3ec1a873ab5a6accab4ab3a290e5989:/app/controllers/trace_controller.rb diff --git a/app/controllers/trace_controller.rb b/app/controllers/trace_controller.rb index cf35d0046..41ff34303 100644 --- a/app/controllers/trace_controller.rb +++ b/app/controllers/trace_controller.rb @@ -1,7 +1,10 @@ class TraceController < ApplicationController + layout 'site' + before_filter :authorize_web before_filter :authorize, :only => [:api_details, :api_data, :api_create] - layout 'site' + before_filter :check_database_availability, :except => [:api_details, :api_data, :api_create] + before_filter :check_read_availability, :only => [:api_details, :api_data, :api_create] # Counts and selects pages of GPX traces for various criteria (by user, tags, public etc.). # target_user - if set, specifies the user to fetch traces for. if not set will fetch all traces @@ -15,7 +18,7 @@ class TraceController < ApplicationController # set title if target_user.nil? @title = "Public GPS traces" - elsif @user and @user.id == target_user.id + elsif @user and @user == target_user @title = "Your GPS traces" else @title = "Public GPS traces from #{target_user.display_name}" @@ -35,7 +38,7 @@ class TraceController < ApplicationController conditions = ["gpx_files.public = 1"] #2 end else - if @user and @user.id == target_user.id + if @user and @user == target_user conditions = ["gpx_files.user_id = ?", @user.id] #3 (check vs user id, so no join + can't pick up non-public traces by changing name) else conditions = ["gpx_files.public = 1 AND gpx_files.user_id = ?", target_user.id] #4 @@ -85,7 +88,7 @@ class TraceController < ApplicationController @trace = Trace.find(params[:id]) if @trace and @trace.visible? and - (@trace.public? or @trace.user.id == @user.id) + (@trace.public? or @trace.user == @user) @title = "Viewing trace #{@trace.name}" else flash[:notice] = "Trace not found!"