Use OAuth for notes API calls and require authentication to close

diff --git a/app/assets/javascripts/index/notes.js.erb b/app/assets/javascripts/index/notes.js.erb
index a623a51a2a7fce29bf52bd8af0d949af90977c0b..e67749f07d20cbc44e1d188bae244fe0d8912322 100644 (file)
--- a/app/assets/javascripts/index/notes.js.erb
+++ b/app/assets/javascripts/index/notes.js.erb
@@ -171,6 +171,7 @@ $(document).ready(function () {
     $.ajax({
       url: url,
       type: "POST",
+      oauth: true,
       data: {
         lat: location.lat,
         lon: location.lng,
@@ -191,6 +192,7 @@ $(document).ready(function () {
     $.ajax({
       url: url,
       type: "POST",
+      oauth: true,
       data: {
         text: $(form.text).val()
       },

diff --git a/app/assets/javascripts/templates/notes/show.jst.ejs b/app/assets/javascripts/templates/notes/show.jst.ejs
index aa98220f4f362c4f6b191674b71b9fe374a1d351..7063090dfe29fddf53f941c6e48cfaa491062a95 100644 (file)
--- a/app/assets/javascripts/templates/notes/show.jst.ejs
+++ b/app/assets/javascripts/templates/notes/show.jst.ejs
@@ -25,7 +25,7 @@
     <textarea class="comment" name="text" cols="40" rows="5"></textarea>
     <br/>
     <div class="buttons">
-      <input type="submit" name="close" value="<%- I18n.t('javascripts.notes.show.resolve') %>" data-url="<%- note.close_url %>">
+      <input type="submit" name="close" value="<%- I18n.t('javascripts.notes.show.resolve') %>" class="hide_unless_logged_in" data-url="<%- note.close_url %>">
       <input type="submit" name="comment" value="<%- I18n.t('javascripts.notes.show.comment') %>" data-url="<%- note.comment_url %>" disabled="1">
     </div>
   </form>

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index 8a00296555671f7ce4ecb3ff99ca076cbf3c0a69..b25dc9a9ed777e18e0c2f5bc13cb2efec8320211 100644 (file)
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -3,7 +3,9 @@ class NotesController < ApplicationController
   layout 'site', :only => [:mine]
 
   before_filter :check_api_readable
-  before_filter :authorize_web, :only => [:create, :comment, :close, :destroy, :mine]
+  before_filter :authorize_web, :only => [:mine]
+  before_filter :setup_user_auth, :only => [:create, :comment]
+  before_filter :authorize, :only => [:close, :destroy]
   before_filter :check_api_writable, :only => [:create, :comment, :close, :destroy]
   before_filter :set_locale, :only => [:mine]
   after_filter :compress_output

diff --git a/app/views/site/index.html.erb b/app/views/site/index.html.erb
index aa1197a5efd84cee7f9c0bdaa17a6248516ed76e..3efdd9289fd873fbb9a4697777c2406dc52b50f3 100644 (file)
--- a/app/views/site/index.html.erb
+++ b/app/views/site/index.html.erb
@@ -46,3 +46,4 @@
     </tr>
   </table>
 </div>
+