From: Tom Hughes <tom@compton.nu>
Date: Wed, 9 Jan 2019 17:16:01 +0000 (+0000)
Subject: Merge remote-tracking branch 'upstream/pull/2106'
X-Git-Tag: live~4114
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/09b6560e81f56712c6241c7f525df45daf7580c5?hp=414c4b2c36bc78ece037e30bf8139b129abcd280

Merge remote-tracking branch 'upstream/pull/2106'
---

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index 51cc02925..9981f62eb 100644
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -4,6 +4,7 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
+    can [:index, :feed, :read, :download, :query], Changeset
     can :index, ChangesetComment
     can [:index, :permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id], :site
     can [:index, :rss, :show, :comments], DiaryEntry
@@ -24,7 +25,8 @@ class Ability
       can [:account, :go_public, :make_friend, :remove_friend, :api_details, :api_gpx_files], User
       can [:read, :read_one, :update, :update_one, :delete_one], UserPreference
 
-      if user.terms_agreed? || !REQUIRE_TERMS_AGREED # rubocop:disable Style/IfUnlessModifier
+      if user.terms_agreed? || !REQUIRE_TERMS_AGREED
+        can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset
         can :create, ChangesetComment
       end
 
diff --git a/app/abilities/capability.rb b/app/abilities/capability.rb
index b6cad3115..556d4036c 100644
--- a/app/abilities/capability.rb
+++ b/app/abilities/capability.rb
@@ -13,6 +13,7 @@ class Capability
     can [:update, :update_one, :delete_one], UserPreference if capability?(token, :allow_write_prefs)
 
     if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
+      can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset if capability?(token, :allow_write_api)
       can :create, ChangesetComment if capability?(token, :allow_write_api)
     end
 
diff --git a/app/controllers/changesets_controller.rb b/app/controllers/changesets_controller.rb
index e4fd593d7..97ff85f02 100644
--- a/app/controllers/changesets_controller.rb
+++ b/app/controllers/changesets_controller.rb
@@ -8,7 +8,10 @@ class ChangesetsController < ApplicationController
   before_action :authorize_web, :only => [:index, :feed]
   before_action :set_locale, :only => [:index, :feed]
   before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
-  before_action :require_allow_write_api, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
+  before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox]
+
+  authorize_resource
+
   before_action :require_public_data, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
   before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe]
   before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :index, :feed, :subscribe, :unsubscribe]