Merge remote-tracking branch 'upstream/pull/2109'

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index 7138374f376692c37f26644c9b9bfe5731731210..09e9be2cf2c7a92cb3b4afd64ceafa045487dff5 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -4,13 +4,20 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
+    can [:relation, :relation_history, :way, :way_history, :node, :node_history, :changeset, :note], :browse
+    can [:index, :feed, :read, :download, :query], Changeset
     can :index, ChangesetComment
+    can :search, :direction
     can [:index, :permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id], :site
     can [:index, :rss, :show, :comments], DiaryEntry
+    can [:finish, :embed], :export
     can [:search, :search_latlon, :search_ca_postcode, :search_osm_nominatim,
          :search_geonames, :search_osm_nominatim_reverse, :search_geonames_reverse], :geocoder
     can [:index, :create, :comment, :feed, :show, :search, :mine], Note
     can [:index, :show], Redaction
+    can [:search_all, :search_nodes, :search_ways, :search_relations], :search
+    can [:trackpoints], :swf
+    can [:index, :show, :data, :georss, :picture, :icon], Trace
     can [:terms, :api_users, :login, :logout, :new, :create, :save, :confirm, :confirm_resend, :confirm_email, :lost_password, :reset_password, :show, :api_read, :auth_success, :auth_failure], User
     can [:index, :show, :blocks_on, :blocks_by], UserBlock
 
@@ -21,10 +28,12 @@ class Ability
       can [:new, :create, :reply, :show, :inbox, :outbox, :mark, :destroy], Message
       can [:close, :reopen], Note
       can [:new, :create], Report
+      can [:mine, :new, :create, :edit, :update, :delete, :api_create, :api_read, :api_update, :api_delete, :api_data], Trace
       can [:account, :go_public, :make_friend, :remove_friend, :api_details, :api_gpx_files], User
       can [:read, :read_one, :update, :update_one, :delete_one], UserPreference
 
-      if user.terms_agreed? || !REQUIRE_TERMS_AGREED # rubocop:disable Style/IfUnlessModifier
+      if user.terms_agreed? || !REQUIRE_TERMS_AGREED
+        can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset
         can :create, ChangesetComment
       end
 

diff --git a/app/abilities/capability.rb b/app/abilities/capability.rb
index ae30a0ebd00d7e563665a8c900f7981088b10a9a..556d4036cd52714b79e563123460ae0576c993a4 100644 (file)
--- a/app/abilities/capability.rb
+++ b/app/abilities/capability.rb
@@ -5,12 +5,15 @@ class Capability
 
   def initialize(token)
     can [:create, :comment, :close, :reopen], Note if capability?(token, :allow_write_notes)
+    can [:api_read, :api_data], Trace if capability?(token, :allow_read_gpx)
+    can [:api_create, :api_update, :api_delete], Trace if capability?(token, :allow_write_gpx)
     can [:api_details], User if capability?(token, :allow_read_prefs)
     can [:api_gpx_files], User if capability?(token, :allow_read_gpx)
     can [:read, :read_one], UserPreference if capability?(token, :allow_read_prefs)
     can [:update, :update_one, :delete_one], UserPreference if capability?(token, :allow_write_prefs)
 
     if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
+      can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset if capability?(token, :allow_write_api)
       can :create, ChangesetComment if capability?(token, :allow_write_api)
     end
 

diff --git a/app/controllers/amf_controller.rb b/app/controllers/amf_controller.rb
index 4f6adae5da6b08dd38b763f5aff392e53d359ce2..fdad432a8d44802c592e309f54e95d0d9a334f4c 100644 (file)
--- a/app/controllers/amf_controller.rb
+++ b/app/controllers/amf_controller.rb
@@ -41,6 +41,11 @@ class AmfController < ApplicationController
   skip_before_action :verify_authenticity_token
   before_action :check_api_writable
 
+  # AMF Controller implements its own authentication and authorization checks
+  # completely independently of the rest of the codebase, so best just to let
+  # it keep doing its own thing.
+  skip_authorization_check
+
   # Main AMF handlers: process the raw AMF string (using AMF library) and
   # calls each action (private method) accordingly.
 

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index d97feace24d748afa86be812e582493561818d62..90883376c97d7af2cf8239b582baea67d576b7e9 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -253,48 +253,9 @@ class ApiController < ApplicationController
   # * maximum area that can be requested in a bbox request in square degrees
   # * number of tracepoints that are returned in each tracepoints page
   def capabilities
-    doc = OSM::API.new.get_xml_doc
-
-    api = XML::Node.new "api"
-    version = XML::Node.new "version"
-    version["minimum"] = API_VERSION.to_s
-    version["maximum"] = API_VERSION.to_s
-    api << version
-    area = XML::Node.new "area"
-    area["maximum"] = MAX_REQUEST_AREA.to_s
-    api << area
-    notearea = XML::Node.new "note_area"
-    notearea["maximum"] = MAX_NOTE_REQUEST_AREA.to_s
-    api << notearea
-    tracepoints = XML::Node.new "tracepoints"
-    tracepoints["per_page"] = TRACEPOINTS_PER_PAGE.to_s
-    api << tracepoints
-    waynodes = XML::Node.new "waynodes"
-    waynodes["maximum"] = MAX_NUMBER_OF_WAY_NODES.to_s
-    api << waynodes
-    changesets = XML::Node.new "changesets"
-    changesets["maximum_elements"] = Changeset::MAX_ELEMENTS.to_s
-    api << changesets
-    timeout = XML::Node.new "timeout"
-    timeout["seconds"] = API_TIMEOUT.to_s
-    api << timeout
-    status = XML::Node.new "status"
-    status["database"] = database_status.to_s
-    status["api"] = api_status.to_s
-    status["gpx"] = gpx_status.to_s
-    api << status
-    doc.root << api
-    policy = XML::Node.new "policy"
-    blacklist = XML::Node.new "imagery"
-    IMAGERY_BLACKLIST.each do |url_regex|
-      xnd = XML::Node.new "blacklist"
-      xnd["regex"] = url_regex.to_s
-      blacklist << xnd
-    end
-    policy << blacklist
-    doc.root << policy
-
-    render :xml => doc.to_s
+    @database_status = database_status
+    @api_status = api_status
+    @gpx_status = gpx_status
   end
 
   # External apps that use the api are able to query which permissions

diff --git a/app/controllers/browse_controller.rb b/app/controllers/browse_controller.rb
index 6eb9675683f81df3089136e9fdfca2ba62e9ae57..0fccbb506bb2a19dae6db4087853a64b8f0933cf 100644 (file)
--- a/app/controllers/browse_controller.rb
+++ b/app/controllers/browse_controller.rb
@@ -6,6 +6,7 @@ class BrowseController < ApplicationController
   before_action(:except => [:query]) { |c| c.check_database_readable(true) }
   before_action :require_oauth
   around_action :web_timeout
+  authorize_resource :class => false
 
   def relation
     @type = "relation"

diff --git a/app/controllers/changesets_controller.rb b/app/controllers/changesets_controller.rb
index e4fd593d7d35d34015640d002ec8a59ae922e20c..97ff85f0259cc90f4a3b3dc7186e679f5f5fc5c5 100644 (file)
--- a/app/controllers/changesets_controller.rb
+++ b/app/controllers/changesets_controller.rb
@@ -8,7 +8,10 @@ class ChangesetsController < ApplicationController
   before_action :authorize_web, :only => [:index, :feed]
   before_action :set_locale, :only => [:index, :feed]
   before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
-  before_action :require_allow_write_api, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
+  before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox]
+
+  authorize_resource
+
   before_action :require_public_data, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
   before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe]
   before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :index, :feed, :subscribe, :unsubscribe]

diff --git a/app/controllers/directions_controller.rb b/app/controllers/directions_controller.rb
index b04db6b6f6aea919cb99fa84fdda5283efb9d37b..ec23274006b8062d30bc84dda00752d4d9cfd54f 100644 (file)
--- a/app/controllers/directions_controller.rb
+++ b/app/controllers/directions_controller.rb
@@ -2,6 +2,7 @@ class DirectionsController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :require_oauth, :only => [:search]
+  authorize_resource :class => false
 
   def search
     render :layout => map_layout

diff --git a/app/controllers/export_controller.rb b/app/controllers/export_controller.rb
index afdf4d8d7e38005f89c310d2f8bf9f0033d84cbb..18ac15c101b47feeb1b518eb12a26a4b1dfe52e9 100644 (file)
--- a/app/controllers/export_controller.rb
+++ b/app/controllers/export_controller.rb
@@ -2,6 +2,7 @@ class ExportController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :update_totp, :only => [:finish]
+  authorize_resource :class => false
 
   caches_page :embed
 

diff --git a/app/controllers/geocoder_controller.rb b/app/controllers/geocoder_controller.rb
index da5245687f73db3fb97871fac05a47876420f017..b9cf8d096f35a635e8e9ad957258f097e51e8300 100644 (file)
--- a/app/controllers/geocoder_controller.rb
+++ b/app/controllers/geocoder_controller.rb
@@ -6,6 +6,7 @@ class GeocoderController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :require_oauth, :only => [:search]
+  authorize_resource :class => false
 
   def search
     @params = normalize_params

diff --git a/app/controllers/search_controller.rb b/app/controllers/search_controller.rb
index 0d40b6691ab4e69e6fac431004d61a9327522e64..3a2e4040f894b5048f6ef804e94a767b40ce9086 100644 (file)
--- a/app/controllers/search_controller.rb
+++ b/app/controllers/search_controller.rb
@@ -3,6 +3,7 @@ class SearchController < ApplicationController
   # Can search by tag k, v, or both (type->k,value->v)
   # Can search by name (k=name,v=....)
   skip_before_action :verify_authenticity_token
+  authorize_resource :class => false
 
   def search_all
     do_search(true, true, true)

diff --git a/app/controllers/swf_controller.rb b/app/controllers/swf_controller.rb
index 96237f029c3eaa075d2137eec7b47bb16142131f..1a424c387b693611db04c5bf69e8e465d86b5209 100644 (file)
--- a/app/controllers/swf_controller.rb
+++ b/app/controllers/swf_controller.rb
@@ -1,6 +1,7 @@
 class SwfController < ApplicationController
   skip_before_action :verify_authenticity_token
   before_action :check_api_readable
+  authorize_resource :class => false
 
   # to log:
   # RAILS_DEFAULT_LOGGER.error("Args: #{args[0]}, #{args[1]}, #{args[2]}, #{args[3]}")

diff --git a/app/controllers/traces_controller.rb b/app/controllers/traces_controller.rb
index b78ae295916dce42ef7ca294dec170977e14cdad..253bc4160aed3295937cd41227910e04c8b14cdf 100644 (file)
--- a/app/controllers/traces_controller.rb
+++ b/app/controllers/traces_controller.rb
@@ -4,14 +4,15 @@ class TracesController < ApplicationController
   skip_before_action :verify_authenticity_token, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
   before_action :authorize_web
   before_action :set_locale
-  before_action :require_user, :only => [:mine, :new, :create, :edit, :delete]
   before_action :authorize, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
+  before_action :api_deny_access_handler, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
+
+  authorize_resource
+
   before_action :check_database_readable, :except => [:api_read, :api_data]
   before_action :check_database_writable, :only => [:new, :create, :edit, :delete, :api_create, :api_update, :api_delete]
   before_action :check_api_readable, :only => [:api_read, :api_data]
   before_action :check_api_writable, :only => [:api_create, :api_update, :api_delete]
-  before_action :require_allow_read_gpx, :only => [:api_read, :api_data]
-  before_action :require_allow_write_gpx, :only => [:api_create, :api_update, :api_delete]
   before_action :offline_warning, :only => [:mine, :show]
   before_action :offline_redirect, :only => [:new, :create, :edit, :delete, :data, :api_create, :api_delete, :api_data]
   around_action :api_call_handle_error, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]

diff --git a/app/views/api/capabilities.builder b/app/views/api/capabilities.builder
new file mode 100644 (file)
index 0000000..3fa7905
--- /dev/null
+++ b/app/views/api/capabilities.builder
@@ -0,0 +1,22 @@
+xml.instruct! :xml, :version => "1.0"
+xml.osm(OSM::API.new.xml_root_attributes) do |osm|
+  osm.api do |api|
+    api.version(:minimum => API_VERSION.to_s, :maximum => API_VERSION.to_s)
+    api.area(:maximum => MAX_REQUEST_AREA.to_s)
+    api.note_area(:maximum => MAX_NOTE_REQUEST_AREA.to_s)
+    api.tracepoints(:per_page => TRACEPOINTS_PER_PAGE.to_s)
+    api.waynodes(:maximum => MAX_NUMBER_OF_WAY_NODES.to_s)
+    api.changesets(:maximum_elements => Changeset::MAX_ELEMENTS.to_s)
+    api.timeout(:seconds => API_TIMEOUT.to_s)
+    api.status(:database => @database_status.to_s,
+               :api => @api_status.to_s,
+               :gpx => @gpx_status.to_s)
+  end
+  osm.policy do |policy|
+    policy.imagery do |imagery|
+      IMAGERY_BLACKLIST.each do |url_regex|
+        imagery.blacklist(:regex => url_regex.to_s)
+      end
+    end
+  end
+end

diff --git a/app/views/api/permissions.builder b/app/views/api/permissions.builder
index 6d26a9e532521d05f826c3a38edb8a9d0462bb8e..f97dd55f88fbbe0c83cde0ee0653ccfcc76a80f4 100644 (file)
--- a/app/views/api/permissions.builder
+++ b/app/views/api/permissions.builder
@@ -1,6 +1,6 @@
 # create list of permissions
 xml.instruct! :xml, :version => "1.0"
-xml.osm("version" => API_VERSION.to_s, "generator" => "OpenStreetMap Server") do
+xml.osm(OSM::API.new.xml_root_attributes) do
   xml.permissions do
     @permissions.each do |permission|
       xml.permission :name => permission

diff --git a/app/views/notes/index.xml.builder b/app/views/notes/index.xml.builder
index c1c2be7e40a79d2e1eec16a6129443d2119c7f49..286b1e1ccecd0b8513e77d41bc442aff826e21a1 100644 (file)
--- a/app/views/notes/index.xml.builder
+++ b/app/views/notes/index.xml.builder
@@ -1,5 +1,5 @@
 xml.instruct!
 
-xml.osm(:version => API_VERSION, :generator => GENERATOR) do |osm|
+xml.osm(OSM::API.new.xml_root_attributes) do |osm|
   osm << (render(:partial => "note", :collection => @notes) || "")
 end

diff --git a/app/views/notes/show.xml.builder b/app/views/notes/show.xml.builder
index f16cda3a620746dbef9bdc20b3f8c19849ddd4c1..51b3daebd330db43c1cae2036a4efcff42cf2781 100644 (file)
--- a/app/views/notes/show.xml.builder
+++ b/app/views/notes/show.xml.builder
@@ -1,5 +1,5 @@
 xml.instruct!
 
-xml.osm(:version => API_VERSION, :generator => GENERATOR) do |osm|
+xml.osm(OSM::API.new.xml_root_attributes) do |osm|
   osm << render(:partial => "note", :object => @note)
 end

diff --git a/app/views/users/api_read.builder b/app/views/users/api_read.builder
index 1598f3c535c59dec65af27a0402cb3bc884fb162..78533279c6adcec93c86c2d820d328c80ad04247 100644 (file)
--- a/app/views/users/api_read.builder
+++ b/app/views/users/api_read.builder
@@ -1,4 +1,4 @@
 xml.instruct! :xml, :version => "1.0"
-xml.osm("version" => API_VERSION, "generator" => GENERATOR) do |osm|
+xml.osm(OSM::API.new.xml_root_attributes) do |osm|
   osm << render(:partial => "api_user", :object => @user)
 end

diff --git a/app/views/users/api_users.builder b/app/views/users/api_users.builder
index 1d2475743ae931c9a5eaf3a166e3688eb5112202..a3c0f4d9a493e2168e40257dbad4739ca47694de 100644 (file)
--- a/app/views/users/api_users.builder
+++ b/app/views/users/api_users.builder
@@ -1,4 +1,4 @@
 xml.instruct! :xml, :version => "1.0"
-xml.osm("version" => API_VERSION, "generator" => GENERATOR) do |osm|
+xml.osm(OSM::API.new.xml_root_attributes) do |osm|
   osm << render(:partial => "api_user", :collection => @users)
 end

diff --git a/lib/osm.rb b/lib/osm.rb
index 841cce17b8f49dba022de129d7d50b04aba63335..1951e3c31287f82d1bc15929a17573834e3a0c6e 100644 (file)
--- a/lib/osm.rb
+++ b/lib/osm.rb
@@ -494,14 +494,20 @@ module OSM
       doc = XML::Document.new
       doc.encoding = XML::Encoding::UTF_8
       root = XML::Node.new "osm"
-      root["version"] = API_VERSION.to_s
-      root["generator"] = GENERATOR
-      root["copyright"] = COPYRIGHT_OWNER
-      root["attribution"] = ATTRIBUTION_URL
-      root["license"] = LICENSE_URL
+      xml_root_attributes.each do |k, v|
+        root[k] = v
+      end
       doc.root = root
       doc
     end
+
+    def xml_root_attributes
+      { "version" => API_VERSION.to_s,
+        "generator" => GENERATOR,
+        "copyright" => COPYRIGHT_OWNER,
+        "attribution" => ATTRIBUTION_URL,
+        "license" => LICENSE_URL }
+    end
   end
 
   def self.ip_to_country(ip_address)