X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/d102c9aaf478a4bad52a72b1b72470ba35ba464e..7b057545c0b2030aad9981bd93699f9e33ad7d5f:/app/controllers/application_controller.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 0e77a398d..c880e6add 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -12,6 +12,8 @@ class ApplicationController < ActionController::Base attr_accessor :current_user helper_method :current_user + private + def authorize_web if session[:user] self.current_user = User.where(:id => session[:user]).where("status IN ('active', 'confirmed', 'suspended')").first @@ -71,62 +73,8 @@ class ApplicationController < ActionController::Base end end - ## - # sets up the current_user for use by other methods. this is mostly called - # from the authorize method, but can be called elsewhere if authorisation - # is optional. - def setup_user_auth - # try and setup using OAuth - unless Authenticator.new(self, [:token]).allow? - username, passwd = get_auth_data # parse from headers - # authenticate per-scheme - self.current_user = if username.nil? - nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == "token" - User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth - else - User.authenticate(:username => username, :password => passwd) # basic auth - end - end - - # have we identified the user? - if current_user - # check if the user has been banned - user_block = current_user.blocks.active.take - unless user_block.nil? - set_locale - if user_block.zero_hour? - report_error t("application.setup_user_auth.blocked_zero_hour"), :forbidden - else - report_error t("application.setup_user_auth.blocked"), :forbidden - end - end - - # if the user hasn't seen the contributor terms then don't - # allow editing - they have to go to the web site and see - # (but can decline) the CTs to continue. - if !current_user.terms_seen && flash[:skip_terms].nil? - set_locale - report_error t("application.setup_user_auth.need_to_see_terms"), :forbidden - end - end - end - - def authorize(realm = "Web Password", errormessage = "Couldn't authenticate you") - # make the current_user object from any auth sources we have - setup_user_auth - - # handle authenticate pass/fail - unless current_user - # no auth, the user does not exist or the password was wrong - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - return false - end - end - def check_database_readable(need_api = false) - if STATUS == :database_offline || (need_api && STATUS == :api_offline) + if Settings.status == "database_offline" || (need_api && Settings.status == "api_offline") if request.xhr? report_error "Database offline for maintenance", :service_unavailable else @@ -136,8 +84,8 @@ class ApplicationController < ActionController::Base end def check_database_writable(need_api = false) - if STATUS == :database_offline || STATUS == :database_readonly || - (need_api && (STATUS == :api_offline || STATUS == :api_readonly)) + if Settings.status == "database_offline" || Settings.status == "database_readonly" || + (need_api && (Settings.status == "api_offline" || Settings.status == "api_readonly")) if request.xhr? report_error "Database offline for maintenance", :service_unavailable else @@ -147,47 +95,41 @@ class ApplicationController < ActionController::Base end def check_api_readable - if api_status == :offline + if api_status == "offline" report_error "Database offline for maintenance", :service_unavailable false end end def check_api_writable - unless api_status == :online + unless api_status == "online" report_error "Database offline for maintenance", :service_unavailable false end end def database_status - if STATUS == :database_offline - :offline - elsif STATUS == :database_readonly - :readonly + if Settings.status == "database_offline" + "offline" + elsif Settings.status == "database_readonly" + "readonly" else - :online + "online" end end def api_status status = database_status - if status == :online - if STATUS == :api_offline - status = :offline - elsif STATUS == :api_readonly - status = :readonly + if status == "online" + if Settings.status == "api_offline" + status = "offline" + elsif Settings.status == "api_readonly" + status = "readonly" end end status end - def gpx_status - status = database_status - status = :offline if status == :online && STATUS == :gpx_offline - status - end - def require_public_data unless current_user.data_public? report_error "You must make your edits public to upload new data", :forbidden @@ -338,9 +280,9 @@ class ApplicationController < ActionController::Base :style_src => %w['unsafe-inline'] ) - if STATUS == :database_offline || STATUS == :api_offline + if Settings.status == "database_offline" || Settings.status == "api_offline" flash.now[:warning] = t("layouts.osm_offline") - elsif STATUS == :database_readonly || STATUS == :api_readonly + elsif Settings.status == "database_readonly" || Settings.status == "api_readonly" flash.now[:warning] = t("layouts.osm_read_only") end @@ -387,23 +329,10 @@ class ApplicationController < ActionController::Base end def current_ability - # Use capabilities from the oauth token if it exists and is a valid access token - if Authenticator.new(self, [:token]).allow? - Ability.new(nil).merge(Capability.new(current_token)) - else - Ability.new(current_user) - end + Ability.new(current_user) end - def deny_access(exception) - if @api_deny_access_handling - api_deny_access(exception) - else - web_deny_access(exception) - end - end - - def web_deny_access(_exception) + def deny_access(_exception) if current_token set_locale report_error t("oauth.permissions.missing"), :forbidden @@ -423,28 +352,6 @@ class ApplicationController < ActionController::Base end end - def api_deny_access(_exception) - if current_token - set_locale - report_error t("oauth.permissions.missing"), :forbidden - elsif current_user - head :forbidden - else - realm = "Web Password" - errormessage = "Couldn't authenticate you" - response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\"" - render :plain => errormessage, :status => :unauthorized - end - end - - attr_accessor :api_access_handling - - def api_deny_access_handler - @api_deny_access_handling = true - end - - private - # extract authorisation credentials from headers, returns user = nil if none def get_auth_data if request.env.key? "X-HTTP_AUTHORIZATION" # where mod_rewrite might have put it