X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/9617ca2accf5f00b75e5b7323bda435b6f596ea0..c6bf21a9d054f29d788272767b7a77d58fe56aec:/app/controllers/trace_controller.rb

diff --git a/app/controllers/trace_controller.rb b/app/controllers/trace_controller.rb
index 1dee0b924..f06a162fb 100644
--- a/app/controllers/trace_controller.rb
+++ b/app/controllers/trace_controller.rb
@@ -9,6 +9,8 @@ class TraceController < ApplicationController
   before_filter :check_database_writable, :only => [:create, :edit, :delete]
   before_filter :check_api_readable, :only => [:api_details, :api_data]
   before_filter :check_api_writable, :only => [:api_create]
+  before_filter :require_allow_read_gpx, :only => [:api_details, :api_data]
+  before_filter :require_allow_write_gpx, :only => [:api_create]
  
   # Counts and selects pages of GPX traces for various criteria (by user, tags, public etc.).
   #  target_user - if set, specifies the user to fetch traces for.  if not set will fetch all traces
@@ -43,15 +45,15 @@ class TraceController < ApplicationController
     # 4 - user's traces, not logged in as that user = all user's public traces
     if target_user.nil? # all traces
       if @user
-        conditions = ["(gpx_files.visibility in ('public', 'identifiable') OR gpx_files.user_id = ?)", @user.id] #1
+        conditions = ["(gpx_files.visibility <> 'private' OR gpx_files.user_id = ?)", @user.id] #1
       else
-        conditions  = ["gpx_files.visibility in ('public', 'identifiable')"] #2
+        conditions  = ["gpx_files.visibility <> 'private'"] #2
       end
     else
       if @user and @user == target_user
         conditions = ["gpx_files.user_id = ?", @user.id] #3 (check vs user id, so no join + can't pick up non-public traces by changing name)
       else
-        conditions = ["gpx_files.visibility in ('public', 'identifiable') AND gpx_files.user_id = ?", target_user.id] #4
+        conditions = ["gpx_files.public <> 'private' AND gpx_files.user_id = ?", target_user.id] #4
       end
     end
     
@@ -205,7 +207,7 @@ class TraceController < ApplicationController
   end
 
   def georss
-    conditions = ["gpx_files.visibility in ('public', 'identifiable')"]
+    conditions = ["gpx_files.visibility <> 'private'"]
 
     if params[:display_name]
       conditions[0] += " AND users.display_name = ?"