X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/f4571eeb7cb4f920bb5d642c9e1c37c9495fc6ba..8df391f41f3be43866e655dae5c6a52c7c0a2aa6:/app/controllers/application_controller.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 0d6cdea64..0c4117047 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -22,19 +22,80 @@ class ApplicationController < ActionController::Base redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri unless @user end + ## + # requires the user to be logged in by the token or HTTP methods, or have an + # OAuth token with the right capability. this method is a bit of a pain to call + # directly, since it's cumbersome to call filters with arguments in rails. to + # make it easier to read and write the code, there are some utility methods + # below. + def require_capability(cap) + # when the current token is nil, it means the user logged in with a different + # method, otherwise an OAuth token was used, which has to be checked. + unless current_token.nil? + unless current_token.read_attribute(cap) + render :text => "OAuth token doesn't have that capability.", :status => :forbidden + return false + end + end + end + + ## + # require the user to have cookies enabled in their browser + def require_cookies + if request.cookies["_osm_session"].to_s == "" + if params[:cookie_test].nil? + redirect_to params.merge(:cookie_test => "true") + return false + else + flash.now[:warning] = t 'application.require_cookies.cookies_needed' + end + end + end + + # Utility methods to make the controller filter methods easier to read and write. + def require_allow_read_prefs + require_capability(:allow_read_prefs) + end + def require_allow_write_prefs + require_capability(:allow_write_prefs) + end + def require_allow_write_diary + require_capability(:allow_write_diary) + end + def require_allow_write_api + require_capability(:allow_write_api) + end + def require_allow_read_gpx + require_capability(:allow_read_gpx) + end + def require_allow_write_gpx + require_capability(:allow_write_gpx) + end + ## # sets up the @user object for use by other methods. this is mostly called # from the authorize method, but can be called elsewhere if authorisation # is optional. def setup_user_auth - username, passwd = get_auth_data # parse from headers - # authenticate per-scheme - if username.nil? - @user = nil # no authentication provided - perhaps first connect (client should retry after 401) - elsif username == 'token' - @user = User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth + # try and setup using OAuth + if oauthenticate + @user = current_token.user else - @user = User.authenticate(:username => username, :password => passwd) # basic auth + username, passwd = get_auth_data # parse from headers + # authenticate per-scheme + if username.nil? + @user = nil # no authentication provided - perhaps first connect (client should retry after 401) + elsif username == 'token' + @user = User.authenticate(:token => passwd) # preferred - random token for user from db, passed in basic auth + else + @user = User.authenticate(:username => username, :password => passwd) # basic auth + end + end + + # check if the user has been banned + unless @user.nil? or @user.active_blocks.empty? + # NOTE: need slightly more helpful message than this. + render :text => t('application.setup_user_auth.blocked'), :status => :forbidden end end @@ -101,9 +162,12 @@ class ApplicationController < ActionController::Base end def set_locale + response.header['Vary'] = 'Accept-Language' + if @user if !@user.languages.empty? request.user_preferred_languages = @user.languages + response.header['Vary'] = '*' elsif !request.user_preferred_languages.empty? @user.languages = request.user_preferred_languages @user.save @@ -128,7 +192,11 @@ class ApplicationController < ActionController::Base report_error message, :bad_request rescue OSM::APIError => ex report_error ex.message, ex.status + rescue ActionController::UnknownAction => ex + raise rescue Exception => ex + logger.info("API threw unexpected #{ex.class} exception: #{ex.message}") + ex.backtrace.each { |l| logger.info(l) } report_error "#{ex.class}: #{ex.message}", :internal_server_error end end @@ -142,12 +210,54 @@ class ApplicationController < ActionController::Base end def api_call_timeout - Timeout::timeout(APP_CONFIG['api_timeout'], OSM::APITimeoutError) do + SystemTimer.timeout_after(APP_CONFIG['api_timeout']) do yield end + rescue Timeout::Error + raise OSM::APITimeoutError + end + + ## + # extend caches_action to include the parameters, locale and logged in + # status in all cache keys + def self.caches_action(*actions) + options = actions.extract_options! + cache_path = options[:cache_path] || Hash.new + + options[:cache_path] = Proc.new do |controller| + user = controller.instance_variable_get("@user") + + case + when user.nil? then user = :none + when user.display_name == controller.params[:display_name] then user = :self + when user.administrator? then user = :administrator + when user.moderator? then user = :moderator + else user = :other + end + + cache_path.merge(controller.params).merge(:locale => I18n.locale, :user => user) + end + + actions.push(options) + + super *actions + end + + ## + # extend expire_action to expire all variants + def expire_action(options = {}) + path = ActionCachePath.path_for(self, options, false).gsub('?', '.').gsub(':', '.') + expire_fragment(Regexp.new(Regexp.escape(path) + "\\..*")) + end + + ## + # is the requestor logged in? + def logged_in? + !@user.nil? end private + # extract authorisation credentials from headers, returns user = nil if none def get_auth_data if request.env.has_key? 'X-HTTP_AUTHORIZATION' # where mod_rewrite might have put it