Chris@441
|
1 # Redmine - project management software
|
Chris@441
|
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
|
Chris@0
|
3 #
|
Chris@0
|
4 # This program is free software; you can redistribute it and/or
|
Chris@0
|
5 # modify it under the terms of the GNU General Public License
|
Chris@0
|
6 # as published by the Free Software Foundation; either version 2
|
Chris@0
|
7 # of the License, or (at your option) any later version.
|
Chris@441
|
8 #
|
Chris@0
|
9 # This program is distributed in the hope that it will be useful,
|
Chris@0
|
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
|
Chris@0
|
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
Chris@0
|
12 # GNU General Public License for more details.
|
Chris@441
|
13 #
|
Chris@0
|
14 # You should have received a copy of the GNU General Public License
|
Chris@0
|
15 # along with this program; if not, write to the Free Software
|
Chris@0
|
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
Chris@0
|
17
|
Chris@0
|
18 require 'uri'
|
Chris@0
|
19 require 'cgi'
|
Chris@0
|
20
|
Chris@507
|
21 class Unauthorized < Exception; end
|
Chris@507
|
22
|
Chris@0
|
23 class ApplicationController < ActionController::Base
|
Chris@0
|
24 include Redmine::I18n
|
Chris@0
|
25
|
Chris@0
|
26 layout 'base'
|
Chris@119
|
27 exempt_from_layout 'builder', 'rsb'
|
Chris@441
|
28
|
Chris@0
|
29 # Remove broken cookie after upgrade from 0.8.x (#4292)
|
Chris@0
|
30 # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
|
Chris@0
|
31 # TODO: remove it when Rails is fixed
|
Chris@0
|
32 before_filter :delete_broken_cookies
|
Chris@0
|
33 def delete_broken_cookies
|
Chris@0
|
34 if cookies['_redmine_session'] && cookies['_redmine_session'] !~ /--/
|
Chris@441
|
35 cookies.delete '_redmine_session'
|
Chris@0
|
36 redirect_to home_path
|
Chris@0
|
37 return false
|
Chris@0
|
38 end
|
Chris@0
|
39 end
|
Chris@441
|
40
|
Chris@0
|
41 before_filter :user_setup, :check_if_login_required, :set_localization
|
Chris@0
|
42 filter_parameter_logging :password
|
Chris@0
|
43 protect_from_forgery
|
Chris@441
|
44
|
Chris@0
|
45 rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
|
Chris@507
|
46 rescue_from ::Unauthorized, :with => :deny_access
|
Chris@441
|
47
|
Chris@0
|
48 include Redmine::Search::Controller
|
Chris@0
|
49 include Redmine::MenuManager::MenuController
|
Chris@0
|
50 helper Redmine::MenuManager::MenuHelper
|
Chris@441
|
51
|
Chris@0
|
52 Redmine::Scm::Base.all.each do |scm|
|
Chris@0
|
53 require_dependency "repository/#{scm.underscore}"
|
Chris@0
|
54 end
|
Chris@0
|
55
|
Chris@0
|
56 def user_setup
|
Chris@0
|
57 # Check the settings cache for each request
|
Chris@0
|
58 Setting.check_cache
|
Chris@0
|
59 # Find the current user
|
Chris@0
|
60 User.current = find_current_user
|
Chris@0
|
61 end
|
Chris@441
|
62
|
Chris@0
|
63 # Returns the current user or nil if no user is logged in
|
Chris@0
|
64 # and starts a session if needed
|
Chris@0
|
65 def find_current_user
|
Chris@0
|
66 if session[:user_id]
|
Chris@0
|
67 # existing session
|
Chris@0
|
68 (User.active.find(session[:user_id]) rescue nil)
|
Chris@0
|
69 elsif cookies[:autologin] && Setting.autologin?
|
Chris@0
|
70 # auto-login feature starts a new session
|
Chris@0
|
71 user = User.try_to_autologin(cookies[:autologin])
|
Chris@0
|
72 session[:user_id] = user.id if user
|
Chris@0
|
73 user
|
Chris@507
|
74 elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
|
Chris@0
|
75 # RSS key authentication does not start a session
|
Chris@0
|
76 User.find_by_rss_key(params[:key])
|
Chris@507
|
77 elsif Setting.rest_api_enabled? && accept_api_auth?
|
Chris@507
|
78 if (key = api_key_from_request)
|
Chris@0
|
79 # Use API key
|
Chris@119
|
80 User.find_by_api_key(key)
|
Chris@0
|
81 else
|
Chris@0
|
82 # HTTP Basic, either username/password or API key/random
|
Chris@0
|
83 authenticate_with_http_basic do |username, password|
|
Chris@0
|
84 User.try_to_login(username, password) || User.find_by_api_key(username)
|
Chris@0
|
85 end
|
Chris@0
|
86 end
|
Chris@0
|
87 end
|
Chris@0
|
88 end
|
Chris@0
|
89
|
Chris@0
|
90 # Sets the logged in user
|
Chris@0
|
91 def logged_user=(user)
|
Chris@0
|
92 reset_session
|
Chris@0
|
93 if user && user.is_a?(User)
|
Chris@0
|
94 User.current = user
|
Chris@0
|
95 session[:user_id] = user.id
|
Chris@0
|
96 else
|
Chris@0
|
97 User.current = User.anonymous
|
Chris@0
|
98 end
|
Chris@0
|
99 end
|
Chris@441
|
100
|
Chris@0
|
101 # check if login is globally required to access the application
|
Chris@0
|
102 def check_if_login_required
|
Chris@0
|
103 # no check needed if user is already logged in
|
Chris@0
|
104 return true if User.current.logged?
|
Chris@0
|
105 require_login if Setting.login_required?
|
Chris@441
|
106 end
|
Chris@441
|
107
|
Chris@0
|
108 def set_localization
|
Chris@0
|
109 lang = nil
|
Chris@0
|
110 if User.current.logged?
|
Chris@0
|
111 lang = find_language(User.current.language)
|
Chris@0
|
112 end
|
Chris@0
|
113 if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
|
Chris@0
|
114 accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
|
Chris@0
|
115 if !accept_lang.blank?
|
Chris@0
|
116 accept_lang = accept_lang.downcase
|
Chris@0
|
117 lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
|
Chris@0
|
118 end
|
Chris@0
|
119 end
|
Chris@0
|
120 lang ||= Setting.default_language
|
Chris@0
|
121 set_language_if_valid(lang)
|
Chris@0
|
122 end
|
Chris@441
|
123
|
Chris@0
|
124 def require_login
|
Chris@0
|
125 if !User.current.logged?
|
Chris@0
|
126 # Extract only the basic url parameters on non-GET requests
|
Chris@0
|
127 if request.get?
|
Chris@0
|
128 url = url_for(params)
|
Chris@0
|
129 else
|
Chris@0
|
130 url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
|
Chris@0
|
131 end
|
Chris@0
|
132 respond_to do |format|
|
Chris@0
|
133 format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
|
Chris@0
|
134 format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
|
Chris@0
|
135 format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
|
Chris@0
|
136 format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
|
Chris@0
|
137 format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
|
Chris@0
|
138 end
|
Chris@0
|
139 return false
|
Chris@0
|
140 end
|
Chris@0
|
141 true
|
Chris@0
|
142 end
|
Chris@0
|
143
|
Chris@0
|
144 def require_admin
|
Chris@0
|
145 return unless require_login
|
Chris@0
|
146 if !User.current.admin?
|
Chris@0
|
147 render_403
|
Chris@0
|
148 return false
|
Chris@0
|
149 end
|
Chris@0
|
150 true
|
Chris@0
|
151 end
|
Chris@441
|
152
|
Chris@0
|
153 def deny_access
|
Chris@0
|
154 User.current.logged? ? render_403 : require_login
|
Chris@0
|
155 end
|
Chris@0
|
156
|
Chris@0
|
157 # Authorize the user for the requested action
|
Chris@0
|
158 def authorize(ctrl = params[:controller], action = params[:action], global = false)
|
chris@37
|
159 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
|
chris@37
|
160 if allowed
|
chris@37
|
161 true
|
chris@37
|
162 else
|
chris@37
|
163 if @project && @project.archived?
|
chris@37
|
164 render_403 :message => :notice_not_authorized_archived_project
|
chris@37
|
165 else
|
chris@37
|
166 deny_access
|
chris@37
|
167 end
|
chris@37
|
168 end
|
Chris@0
|
169 end
|
Chris@0
|
170
|
Chris@0
|
171 # Authorize the user for the requested action outside a project
|
Chris@0
|
172 def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
|
Chris@0
|
173 authorize(ctrl, action, global)
|
Chris@0
|
174 end
|
Chris@0
|
175
|
Chris@0
|
176 # Find project of id params[:id]
|
Chris@0
|
177 def find_project
|
Chris@0
|
178 @project = Project.find(params[:id])
|
Chris@0
|
179 rescue ActiveRecord::RecordNotFound
|
Chris@0
|
180 render_404
|
Chris@0
|
181 end
|
Chris@0
|
182
|
chris@22
|
183 # Find project of id params[:project_id]
|
chris@22
|
184 def find_project_by_project_id
|
chris@22
|
185 @project = Project.find(params[:project_id])
|
chris@22
|
186 rescue ActiveRecord::RecordNotFound
|
chris@22
|
187 render_404
|
chris@22
|
188 end
|
chris@22
|
189
|
Chris@0
|
190 # Find a project based on params[:project_id]
|
Chris@0
|
191 # TODO: some subclasses override this, see about merging their logic
|
Chris@0
|
192 def find_optional_project
|
Chris@0
|
193 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
|
Chris@0
|
194 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
|
Chris@0
|
195 allowed ? true : deny_access
|
Chris@0
|
196 rescue ActiveRecord::RecordNotFound
|
Chris@0
|
197 render_404
|
Chris@0
|
198 end
|
Chris@0
|
199
|
Chris@0
|
200 # Finds and sets @project based on @object.project
|
Chris@0
|
201 def find_project_from_association
|
Chris@0
|
202 render_404 unless @object.present?
|
Chris@441
|
203
|
Chris@0
|
204 @project = @object.project
|
Chris@0
|
205 rescue ActiveRecord::RecordNotFound
|
Chris@0
|
206 render_404
|
Chris@0
|
207 end
|
Chris@0
|
208
|
Chris@0
|
209 def find_model_object
|
Chris@0
|
210 model = self.class.read_inheritable_attribute('model_object')
|
Chris@0
|
211 if model
|
Chris@0
|
212 @object = model.find(params[:id])
|
Chris@0
|
213 self.instance_variable_set('@' + controller_name.singularize, @object) if @object
|
Chris@0
|
214 end
|
Chris@0
|
215 rescue ActiveRecord::RecordNotFound
|
Chris@0
|
216 render_404
|
Chris@0
|
217 end
|
Chris@0
|
218
|
Chris@0
|
219 def self.model_object(model)
|
Chris@0
|
220 write_inheritable_attribute('model_object', model)
|
Chris@0
|
221 end
|
Chris@14
|
222
|
Chris@14
|
223 # Filter for bulk issue operations
|
Chris@14
|
224 def find_issues
|
Chris@14
|
225 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
|
Chris@14
|
226 raise ActiveRecord::RecordNotFound if @issues.empty?
|
Chris@441
|
227 if @issues.detect {|issue| !issue.visible?}
|
Chris@441
|
228 deny_access
|
Chris@441
|
229 return
|
Chris@441
|
230 end
|
chris@37
|
231 @projects = @issues.collect(&:project).compact.uniq
|
chris@37
|
232 @project = @projects.first if @projects.size == 1
|
chris@37
|
233 rescue ActiveRecord::RecordNotFound
|
chris@37
|
234 render_404
|
chris@37
|
235 end
|
Chris@441
|
236
|
chris@37
|
237 # Check if project is unique before bulk operations
|
chris@37
|
238 def check_project_uniqueness
|
chris@37
|
239 unless @project
|
Chris@14
|
240 # TODO: let users bulk edit/move/destroy issues from different projects
|
Chris@14
|
241 render_error 'Can not bulk edit/move/destroy issues from different projects'
|
Chris@14
|
242 return false
|
Chris@14
|
243 end
|
Chris@14
|
244 end
|
Chris@441
|
245
|
Chris@0
|
246 # make sure that the user is a member of the project (or admin) if project is private
|
Chris@0
|
247 # used as a before_filter for actions that do not require any particular permission on the project
|
Chris@0
|
248 def check_project_privacy
|
Chris@0
|
249 if @project && @project.active?
|
Chris@0
|
250 if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
|
Chris@0
|
251 true
|
Chris@0
|
252 else
|
Chris@0
|
253 User.current.logged? ? render_403 : require_login
|
Chris@0
|
254 end
|
Chris@0
|
255 else
|
Chris@0
|
256 @project = nil
|
Chris@0
|
257 render_404
|
Chris@0
|
258 false
|
Chris@0
|
259 end
|
Chris@0
|
260 end
|
Chris@0
|
261
|
Chris@14
|
262 def back_url
|
Chris@14
|
263 params[:back_url] || request.env['HTTP_REFERER']
|
Chris@14
|
264 end
|
Chris@14
|
265
|
Chris@0
|
266 def redirect_back_or_default(default)
|
Chris@0
|
267 back_url = CGI.unescape(params[:back_url].to_s)
|
Chris@0
|
268 if !back_url.blank?
|
Chris@0
|
269 begin
|
Chris@0
|
270 uri = URI.parse(back_url)
|
Chris@0
|
271 # do not redirect user to another host or to the login or register page
|
Chris@0
|
272 if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
|
Chris@0
|
273 redirect_to(back_url)
|
Chris@0
|
274 return
|
Chris@0
|
275 end
|
Chris@0
|
276 rescue URI::InvalidURIError
|
Chris@0
|
277 # redirect to default
|
Chris@0
|
278 end
|
Chris@0
|
279 end
|
Chris@0
|
280 redirect_to default
|
Chris@441
|
281 false
|
Chris@0
|
282 end
|
Chris@441
|
283
|
chris@37
|
284 def render_403(options={})
|
Chris@0
|
285 @project = nil
|
chris@37
|
286 render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
|
Chris@0
|
287 return false
|
Chris@0
|
288 end
|
Chris@441
|
289
|
chris@37
|
290 def render_404(options={})
|
chris@37
|
291 render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
|
Chris@0
|
292 return false
|
Chris@0
|
293 end
|
Chris@441
|
294
|
chris@37
|
295 # Renders an error response
|
chris@37
|
296 def render_error(arg)
|
chris@37
|
297 arg = {:message => arg} unless arg.is_a?(Hash)
|
Chris@441
|
298
|
chris@37
|
299 @message = arg[:message]
|
chris@37
|
300 @message = l(@message) if @message.is_a?(Symbol)
|
chris@37
|
301 @status = arg[:status] || 500
|
Chris@441
|
302
|
Chris@0
|
303 respond_to do |format|
|
chris@37
|
304 format.html {
|
chris@37
|
305 render :template => 'common/error', :layout => use_layout, :status => @status
|
Chris@0
|
306 }
|
chris@37
|
307 format.atom { head @status }
|
chris@37
|
308 format.xml { head @status }
|
chris@37
|
309 format.js { head @status }
|
chris@37
|
310 format.json { head @status }
|
Chris@0
|
311 end
|
Chris@0
|
312 end
|
Chris@14
|
313
|
Chris@14
|
314 # Picks which layout to use based on the request
|
Chris@14
|
315 #
|
Chris@14
|
316 # @return [boolean, string] name of the layout to use or false for no layout
|
Chris@14
|
317 def use_layout
|
Chris@14
|
318 request.xhr? ? false : 'base'
|
Chris@14
|
319 end
|
Chris@441
|
320
|
Chris@0
|
321 def invalid_authenticity_token
|
Chris@0
|
322 if api_request?
|
Chris@0
|
323 logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
|
Chris@0
|
324 end
|
Chris@0
|
325 render_error "Invalid form authenticity token."
|
Chris@0
|
326 end
|
Chris@441
|
327
|
Chris@441
|
328 def render_feed(items, options={})
|
Chris@0
|
329 @items = items || []
|
Chris@0
|
330 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
|
Chris@0
|
331 @items = @items.slice(0, Setting.feeds_limit.to_i)
|
Chris@0
|
332 @title = options[:title] || Setting.app_title
|
Chris@0
|
333 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
|
Chris@0
|
334 end
|
Chris@507
|
335
|
Chris@507
|
336 # TODO: remove in Redmine 1.4
|
Chris@0
|
337 def self.accept_key_auth(*actions)
|
Chris@507
|
338 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
|
Chris@507
|
339 accept_rss_auth(*actions)
|
Chris@0
|
340 end
|
Chris@441
|
341
|
Chris@507
|
342 # TODO: remove in Redmine 1.4
|
Chris@0
|
343 def accept_key_auth_actions
|
Chris@507
|
344 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
|
Chris@507
|
345 self.class.accept_rss_auth
|
Chris@507
|
346 end
|
Chris@507
|
347
|
Chris@507
|
348 def self.accept_rss_auth(*actions)
|
Chris@507
|
349 if actions.any?
|
Chris@507
|
350 write_inheritable_attribute('accept_rss_auth_actions', actions)
|
Chris@507
|
351 else
|
Chris@507
|
352 read_inheritable_attribute('accept_rss_auth_actions') || []
|
Chris@507
|
353 end
|
Chris@507
|
354 end
|
Chris@507
|
355
|
Chris@507
|
356 def accept_rss_auth?(action=action_name)
|
Chris@507
|
357 self.class.accept_rss_auth.include?(action.to_sym)
|
Chris@507
|
358 end
|
Chris@507
|
359
|
Chris@507
|
360 def self.accept_api_auth(*actions)
|
Chris@507
|
361 if actions.any?
|
Chris@507
|
362 write_inheritable_attribute('accept_api_auth_actions', actions)
|
Chris@507
|
363 else
|
Chris@507
|
364 read_inheritable_attribute('accept_api_auth_actions') || []
|
Chris@507
|
365 end
|
Chris@507
|
366 end
|
Chris@507
|
367
|
Chris@507
|
368 def accept_api_auth?(action=action_name)
|
Chris@507
|
369 self.class.accept_api_auth.include?(action.to_sym)
|
Chris@0
|
370 end
|
Chris@441
|
371
|
Chris@0
|
372 # Returns the number of objects that should be displayed
|
Chris@0
|
373 # on the paginated list
|
Chris@0
|
374 def per_page_option
|
Chris@0
|
375 per_page = nil
|
Chris@0
|
376 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
|
Chris@0
|
377 per_page = params[:per_page].to_s.to_i
|
Chris@0
|
378 session[:per_page] = per_page
|
Chris@0
|
379 elsif session[:per_page]
|
Chris@0
|
380 per_page = session[:per_page]
|
Chris@0
|
381 else
|
Chris@0
|
382 per_page = Setting.per_page_options_array.first || 25
|
Chris@0
|
383 end
|
Chris@0
|
384 per_page
|
Chris@0
|
385 end
|
Chris@0
|
386
|
Chris@119
|
387 # Returns offset and limit used to retrieve objects
|
Chris@119
|
388 # for an API response based on offset, limit and page parameters
|
Chris@119
|
389 def api_offset_and_limit(options=params)
|
Chris@119
|
390 if options[:offset].present?
|
Chris@119
|
391 offset = options[:offset].to_i
|
Chris@119
|
392 if offset < 0
|
Chris@119
|
393 offset = 0
|
Chris@119
|
394 end
|
Chris@119
|
395 end
|
Chris@119
|
396 limit = options[:limit].to_i
|
Chris@119
|
397 if limit < 1
|
Chris@119
|
398 limit = 25
|
Chris@119
|
399 elsif limit > 100
|
Chris@119
|
400 limit = 100
|
Chris@119
|
401 end
|
Chris@119
|
402 if offset.nil? && options[:page].present?
|
Chris@119
|
403 offset = (options[:page].to_i - 1) * limit
|
Chris@119
|
404 offset = 0 if offset < 0
|
Chris@119
|
405 end
|
Chris@119
|
406 offset ||= 0
|
Chris@441
|
407
|
Chris@119
|
408 [offset, limit]
|
Chris@119
|
409 end
|
Chris@441
|
410
|
Chris@0
|
411 # qvalues http header parser
|
Chris@0
|
412 # code taken from webrick
|
Chris@0
|
413 def parse_qvalues(value)
|
Chris@0
|
414 tmp = []
|
Chris@0
|
415 if value
|
Chris@0
|
416 parts = value.split(/,\s*/)
|
Chris@0
|
417 parts.each {|part|
|
Chris@0
|
418 if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
|
Chris@0
|
419 val = m[1]
|
Chris@0
|
420 q = (m[2] or 1).to_f
|
Chris@0
|
421 tmp.push([val, q])
|
Chris@0
|
422 end
|
Chris@0
|
423 }
|
Chris@0
|
424 tmp = tmp.sort_by{|val, q| -q}
|
Chris@0
|
425 tmp.collect!{|val, q| val}
|
Chris@0
|
426 end
|
Chris@0
|
427 return tmp
|
Chris@0
|
428 rescue
|
Chris@0
|
429 nil
|
Chris@0
|
430 end
|
Chris@441
|
431
|
Chris@0
|
432 # Returns a string that can be used as filename value in Content-Disposition header
|
Chris@0
|
433 def filename_for_content_disposition(name)
|
Chris@0
|
434 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
|
Chris@0
|
435 end
|
Chris@441
|
436
|
Chris@0
|
437 def api_request?
|
Chris@0
|
438 %w(xml json).include? params[:format]
|
Chris@0
|
439 end
|
Chris@441
|
440
|
Chris@119
|
441 # Returns the API key present in the request
|
Chris@119
|
442 def api_key_from_request
|
Chris@119
|
443 if params[:key].present?
|
Chris@119
|
444 params[:key]
|
Chris@119
|
445 elsif request.headers["X-Redmine-API-Key"].present?
|
Chris@119
|
446 request.headers["X-Redmine-API-Key"]
|
Chris@119
|
447 end
|
Chris@119
|
448 end
|
Chris@0
|
449
|
Chris@0
|
450 # Renders a warning flash if obj has unsaved attachments
|
Chris@0
|
451 def render_attachment_warning_if_needed(obj)
|
Chris@0
|
452 flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
|
Chris@0
|
453 end
|
Chris@0
|
454
|
Chris@14
|
455 # Sets the `flash` notice or error based the number of issues that did not save
|
Chris@14
|
456 #
|
Chris@14
|
457 # @param [Array, Issue] issues all of the saved and unsaved Issues
|
Chris@14
|
458 # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
|
Chris@14
|
459 def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
|
Chris@14
|
460 if unsaved_issue_ids.empty?
|
Chris@14
|
461 flash[:notice] = l(:notice_successful_update) unless issues.empty?
|
Chris@14
|
462 else
|
Chris@14
|
463 flash[:error] = l(:notice_failed_to_save_issues,
|
Chris@14
|
464 :count => unsaved_issue_ids.size,
|
Chris@14
|
465 :total => issues.size,
|
Chris@14
|
466 :ids => '#' + unsaved_issue_ids.join(', #'))
|
Chris@14
|
467 end
|
Chris@14
|
468 end
|
Chris@14
|
469
|
Chris@0
|
470 # Rescues an invalid query statement. Just in case...
|
Chris@0
|
471 def query_statement_invalid(exception)
|
Chris@0
|
472 logger.error "Query::StatementInvalid: #{exception.message}" if logger
|
Chris@0
|
473 session.delete(:query)
|
Chris@0
|
474 sort_clear if respond_to?(:sort_clear)
|
Chris@0
|
475 render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
|
Chris@0
|
476 end
|
Chris@0
|
477
|
Chris@0
|
478 # Converts the errors on an ActiveRecord object into a common JSON format
|
Chris@0
|
479 def object_errors_to_json(object)
|
Chris@0
|
480 object.errors.collect do |attribute, error|
|
Chris@0
|
481 { attribute => error }
|
Chris@0
|
482 end.to_json
|
Chris@0
|
483 end
|
Chris@119
|
484
|
Chris@119
|
485 # Renders API response on validation failure
|
Chris@119
|
486 def render_validation_errors(object)
|
Chris@119
|
487 options = { :status => :unprocessable_entity, :layout => false }
|
Chris@119
|
488 options.merge!(case params[:format]
|
Chris@119
|
489 when 'xml'; { :xml => object.errors }
|
Chris@119
|
490 when 'json'; { :json => {'errors' => object.errors} } # ActiveResource client compliance
|
Chris@119
|
491 else
|
Chris@119
|
492 raise "Unknown format #{params[:format]} in #render_validation_errors"
|
Chris@119
|
493 end
|
Chris@119
|
494 )
|
Chris@119
|
495 render options
|
Chris@119
|
496 end
|
Chris@441
|
497
|
Chris@119
|
498 # Overrides #default_template so that the api template
|
Chris@119
|
499 # is used automatically if it exists
|
Chris@119
|
500 def default_template(action_name = self.action_name)
|
Chris@119
|
501 if api_request?
|
Chris@119
|
502 begin
|
Chris@119
|
503 return self.view_paths.find_template(default_template_name(action_name), 'api')
|
Chris@119
|
504 rescue ::ActionView::MissingTemplate
|
Chris@119
|
505 # the api template was not found
|
Chris@119
|
506 # fallback to the default behaviour
|
Chris@119
|
507 end
|
Chris@119
|
508 end
|
Chris@119
|
509 super
|
Chris@119
|
510 end
|
Chris@441
|
511
|
Chris@119
|
512 # Overrides #pick_layout so that #render with no arguments
|
Chris@119
|
513 # doesn't use the layout for api requests
|
Chris@119
|
514 def pick_layout(*args)
|
Chris@119
|
515 api_request? ? nil : super
|
Chris@119
|
516 end
|
Chris@0
|
517 end
|