Merge remote-tracking branch 'upstream/pull/2106'

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index 51cc02925481541e02c3a9c25d519a8be422438f..9981f62ebc1c745a968bcb22ac890d21d7273f71 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -4,6 +4,7 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
+    can [:index, :feed, :read, :download, :query], Changeset
     can :index, ChangesetComment
     can [:index, :permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id], :site
     can [:index, :rss, :show, :comments], DiaryEntry
@@ -24,7 +25,8 @@ class Ability
       can [:account, :go_public, :make_friend, :remove_friend, :api_details, :api_gpx_files], User
       can [:read, :read_one, :update, :update_one, :delete_one], UserPreference
 
-      if user.terms_agreed? || !REQUIRE_TERMS_AGREED # rubocop:disable Style/IfUnlessModifier
+      if user.terms_agreed? || !REQUIRE_TERMS_AGREED
+        can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset
         can :create, ChangesetComment
       end
 

diff --git a/app/abilities/capability.rb b/app/abilities/capability.rb
index b6cad31158672178c4643654cd6fb2a40028318f..556d4036cd52714b79e563123460ae0576c993a4 100644 (file)
--- a/app/abilities/capability.rb
+++ b/app/abilities/capability.rb
@@ -13,6 +13,7 @@ class Capability
     can [:update, :update_one, :delete_one], UserPreference if capability?(token, :allow_write_prefs)
 
     if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
+      can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset if capability?(token, :allow_write_api)
       can :create, ChangesetComment if capability?(token, :allow_write_api)
     end
 

diff --git a/app/controllers/changesets_controller.rb b/app/controllers/changesets_controller.rb
index e4fd593d7d35d34015640d002ec8a59ae922e20c..97ff85f0259cc90f4a3b3dc7186e679f5f5fc5c5 100644 (file)
--- a/app/controllers/changesets_controller.rb
+++ b/app/controllers/changesets_controller.rb
@@ -8,7 +8,10 @@ class ChangesetsController < ApplicationController
   before_action :authorize_web, :only => [:index, :feed]
   before_action :set_locale, :only => [:index, :feed]
   before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
-  before_action :require_allow_write_api, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
+  before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox]
+
+  authorize_resource
+
   before_action :require_public_data, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
   before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe]
   before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :index, :feed, :subscribe, :unsubscribe]