Merge remote-tracking branch 'upstream/pull/2108'

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index 1fcf6cbeef9fc1b5dc657e43811d9044d1342be7..dcaa7e347a572f7040fdea42105f87255da96106 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -4,13 +4,20 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
+    can [:relation, :relation_history, :way, :way_history, :node, :node_history, :changeset, :note], :browse
+    can [:index, :feed, :read, :download, :query], Changeset
     can :index, ChangesetComment
+    can :search, :direction
     can [:index, :permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id], :site
     can [:index, :rss, :show, :comments], DiaryEntry
+    can [:finish, :embed], :export
     can [:search, :search_latlon, :search_ca_postcode, :search_osm_nominatim,
          :search_geonames, :search_osm_nominatim_reverse, :search_geonames_reverse], :geocoder
     can [:index, :create, :comment, :feed, :show, :search, :mine], Note
     can [:index, :show], Redaction
+    can [:search_all, :search_nodes, :search_ways, :search_relations], :search
+    can [:trackpoints], :swf
+    can [:index, :show, :data, :georss, :picture, :icon], Trace
     can [:terms, :api_users, :login, :logout, :new, :create, :save, :confirm, :confirm_resend, :confirm_email, :lost_password, :reset_password, :show, :api_read, :auth_success, :auth_failure], User
     can [:index, :show, :blocks_on, :blocks_by], UserBlock
 
@@ -19,10 +26,12 @@ class Ability
       can [:create, :edit, :comment, :subscribe, :unsubscribe], DiaryEntry
       can [:close, :reopen], Note
       can [:new, :create], Report
+      can [:mine, :new, :create, :edit, :update, :delete, :api_create, :api_read, :api_update, :api_delete, :api_data], Trace
       can [:account, :go_public, :make_friend, :remove_friend, :api_details, :api_gpx_files], User
       can [:read, :read_one, :update, :update_one, :delete_one], UserPreference
 
-      if user.terms_agreed? || !REQUIRE_TERMS_AGREED # rubocop:disable Style/IfUnlessModifier
+      if user.terms_agreed? || !REQUIRE_TERMS_AGREED
+        can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset
         can :create, ChangesetComment
       end
 

diff --git a/app/abilities/capability.rb b/app/abilities/capability.rb
index ae30a0ebd00d7e563665a8c900f7981088b10a9a..556d4036cd52714b79e563123460ae0576c993a4 100644 (file)
--- a/app/abilities/capability.rb
+++ b/app/abilities/capability.rb
@@ -5,12 +5,15 @@ class Capability
 
   def initialize(token)
     can [:create, :comment, :close, :reopen], Note if capability?(token, :allow_write_notes)
+    can [:api_read, :api_data], Trace if capability?(token, :allow_read_gpx)
+    can [:api_create, :api_update, :api_delete], Trace if capability?(token, :allow_write_gpx)
     can [:api_details], User if capability?(token, :allow_read_prefs)
     can [:api_gpx_files], User if capability?(token, :allow_read_gpx)
     can [:read, :read_one], UserPreference if capability?(token, :allow_read_prefs)
     can [:update, :update_one, :delete_one], UserPreference if capability?(token, :allow_write_prefs)
 
     if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
+      can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset if capability?(token, :allow_write_api)
       can :create, ChangesetComment if capability?(token, :allow_write_api)
     end
 

diff --git a/app/controllers/amf_controller.rb b/app/controllers/amf_controller.rb
index 4f6adae5da6b08dd38b763f5aff392e53d359ce2..fdad432a8d44802c592e309f54e95d0d9a334f4c 100644 (file)
--- a/app/controllers/amf_controller.rb
+++ b/app/controllers/amf_controller.rb
@@ -41,6 +41,11 @@ class AmfController < ApplicationController
   skip_before_action :verify_authenticity_token
   before_action :check_api_writable
 
+  # AMF Controller implements its own authentication and authorization checks
+  # completely independently of the rest of the codebase, so best just to let
+  # it keep doing its own thing.
+  skip_authorization_check
+
   # Main AMF handlers: process the raw AMF string (using AMF library) and
   # calls each action (private method) accordingly.
 

diff --git a/app/controllers/browse_controller.rb b/app/controllers/browse_controller.rb
index 6eb9675683f81df3089136e9fdfca2ba62e9ae57..0fccbb506bb2a19dae6db4087853a64b8f0933cf 100644 (file)
--- a/app/controllers/browse_controller.rb
+++ b/app/controllers/browse_controller.rb
@@ -6,6 +6,7 @@ class BrowseController < ApplicationController
   before_action(:except => [:query]) { |c| c.check_database_readable(true) }
   before_action :require_oauth
   around_action :web_timeout
+  authorize_resource :class => false
 
   def relation
     @type = "relation"

diff --git a/app/controllers/changesets_controller.rb b/app/controllers/changesets_controller.rb
index e4fd593d7d35d34015640d002ec8a59ae922e20c..97ff85f0259cc90f4a3b3dc7186e679f5f5fc5c5 100644 (file)
--- a/app/controllers/changesets_controller.rb
+++ b/app/controllers/changesets_controller.rb
@@ -8,7 +8,10 @@ class ChangesetsController < ApplicationController
   before_action :authorize_web, :only => [:index, :feed]
   before_action :set_locale, :only => [:index, :feed]
   before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
-  before_action :require_allow_write_api, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
+  before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox]
+
+  authorize_resource
+
   before_action :require_public_data, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
   before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe]
   before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :index, :feed, :subscribe, :unsubscribe]

diff --git a/app/controllers/directions_controller.rb b/app/controllers/directions_controller.rb
index b04db6b6f6aea919cb99fa84fdda5283efb9d37b..ec23274006b8062d30bc84dda00752d4d9cfd54f 100644 (file)
--- a/app/controllers/directions_controller.rb
+++ b/app/controllers/directions_controller.rb
@@ -2,6 +2,7 @@ class DirectionsController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :require_oauth, :only => [:search]
+  authorize_resource :class => false
 
   def search
     render :layout => map_layout

diff --git a/app/controllers/export_controller.rb b/app/controllers/export_controller.rb
index afdf4d8d7e38005f89c310d2f8bf9f0033d84cbb..18ac15c101b47feeb1b518eb12a26a4b1dfe52e9 100644 (file)
--- a/app/controllers/export_controller.rb
+++ b/app/controllers/export_controller.rb
@@ -2,6 +2,7 @@ class ExportController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :update_totp, :only => [:finish]
+  authorize_resource :class => false
 
   caches_page :embed
 

diff --git a/app/controllers/geocoder_controller.rb b/app/controllers/geocoder_controller.rb
index da5245687f73db3fb97871fac05a47876420f017..b9cf8d096f35a635e8e9ad957258f097e51e8300 100644 (file)
--- a/app/controllers/geocoder_controller.rb
+++ b/app/controllers/geocoder_controller.rb
@@ -6,6 +6,7 @@ class GeocoderController < ApplicationController
   before_action :authorize_web
   before_action :set_locale
   before_action :require_oauth, :only => [:search]
+  authorize_resource :class => false
 
   def search
     @params = normalize_params

diff --git a/app/controllers/search_controller.rb b/app/controllers/search_controller.rb
index 0d40b6691ab4e69e6fac431004d61a9327522e64..3a2e4040f894b5048f6ef804e94a767b40ce9086 100644 (file)
--- a/app/controllers/search_controller.rb
+++ b/app/controllers/search_controller.rb
@@ -3,6 +3,7 @@ class SearchController < ApplicationController
   # Can search by tag k, v, or both (type->k,value->v)
   # Can search by name (k=name,v=....)
   skip_before_action :verify_authenticity_token
+  authorize_resource :class => false
 
   def search_all
     do_search(true, true, true)

diff --git a/app/controllers/swf_controller.rb b/app/controllers/swf_controller.rb
index 96237f029c3eaa075d2137eec7b47bb16142131f..1a424c387b693611db04c5bf69e8e465d86b5209 100644 (file)
--- a/app/controllers/swf_controller.rb
+++ b/app/controllers/swf_controller.rb
@@ -1,6 +1,7 @@
 class SwfController < ApplicationController
   skip_before_action :verify_authenticity_token
   before_action :check_api_readable
+  authorize_resource :class => false
 
   # to log:
   # RAILS_DEFAULT_LOGGER.error("Args: #{args[0]}, #{args[1]}, #{args[2]}, #{args[3]}")

diff --git a/app/controllers/traces_controller.rb b/app/controllers/traces_controller.rb
index b78ae295916dce42ef7ca294dec170977e14cdad..253bc4160aed3295937cd41227910e04c8b14cdf 100644 (file)
--- a/app/controllers/traces_controller.rb
+++ b/app/controllers/traces_controller.rb
@@ -4,14 +4,15 @@ class TracesController < ApplicationController
   skip_before_action :verify_authenticity_token, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
   before_action :authorize_web
   before_action :set_locale
-  before_action :require_user, :only => [:mine, :new, :create, :edit, :delete]
   before_action :authorize, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
+  before_action :api_deny_access_handler, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
+
+  authorize_resource
+
   before_action :check_database_readable, :except => [:api_read, :api_data]
   before_action :check_database_writable, :only => [:new, :create, :edit, :delete, :api_create, :api_update, :api_delete]
   before_action :check_api_readable, :only => [:api_read, :api_data]
   before_action :check_api_writable, :only => [:api_create, :api_update, :api_delete]
-  before_action :require_allow_read_gpx, :only => [:api_read, :api_data]
-  before_action :require_allow_write_gpx, :only => [:api_create, :api_update, :api_delete]
   before_action :offline_warning, :only => [:mine, :show]
   before_action :offline_redirect, :only => [:new, :create, :edit, :delete, :data, :api_create, :api_delete, :api_data]
   around_action :api_call_handle_error, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]