comparison app/controllers/application_controller.rb @ 909:cbb26bc654de redmine-1.3

Update to Redmine 1.3-stable branch (Redmine SVN rev 8964)

   include Redmine::I18n
 
   layout 'base'
   exempt_from_layout 'builder', 'rsb'
 
+  protect_from_forgery
+  def handle_unverified_request
+    super
+    cookies.delete(:autologin)
+  end
   # Remove broken cookie after upgrade from 0.8.x (#4292)
   # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
   # TODO: remove it when Rails is fixed
   before_filter :delete_broken_cookies
   def delete_broken_cookies

     end
   end
 
   before_filter :user_setup, :check_if_login_required, :set_localization
   filter_parameter_logging :password
-  protect_from_forgery
 
   rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
   rescue_from ::Unauthorized, :with => :deny_access
 
   include Redmine::Search::Controller

   # Finds and sets @project based on @object.project
   def find_project_from_association
     render_404 unless @object.present?
 
     @project = @object.project
-  rescue ActiveRecord::RecordNotFound
-    render_404
   end
 
   def find_model_object
     model = self.class.read_inheritable_attribute('model_object')
     if model

   def check_project_privacy
     if @project && @project.active?
       if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
         true
       else
-        User.current.logged? ? render_403 : require_login
+        deny_access
       end
     else
       @project = nil
       render_404
       false

       format.xml { head @status }
       format.js { head @status }
       format.json { head @status }
     end
   end
+  
+  # Filter for actions that provide an API response
+  # but have no HTML representation for non admin users
+  def require_admin_or_api_request
+    return true if api_request?
+    if User.current.admin?
+      true
+    elsif User.current.logged?
+      render_error(:status => 406)
+    else
+      deny_access
+    end
+  end
 
   # Picks which layout to use based on the request
   #
   # @return [boolean, string] name of the layout to use or false for no layout
   def use_layout

   def render_feed(items, options={})
     @items = items || []
     @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
     @items = @items.slice(0, Setting.feeds_limit.to_i)
     @title = options[:title] || Setting.app_title
-    render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
-  end
-  
+    render :template => "common/feed.atom", :layout => false,
+           :content_type => 'application/atom+xml'
+  end
+
   # TODO: remove in Redmine 1.4
   def self.accept_key_auth(*actions)
     ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
     accept_rss_auth(*actions)
   end

   # TODO: remove in Redmine 1.4
   def accept_key_auth_actions
     ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
     self.class.accept_rss_auth
   end
-  
+
   def self.accept_rss_auth(*actions)
     if actions.any?
       write_inheritable_attribute('accept_rss_auth_actions', actions)
     else
       read_inheritable_attribute('accept_rss_auth_actions') || []
     end
   end
-  
+
   def accept_rss_auth?(action=action_name)
     self.class.accept_rss_auth.include?(action.to_sym)
   end
-  
+
   def self.accept_api_auth(*actions)
     if actions.any?
       write_inheritable_attribute('accept_api_auth_actions', actions)
     else
       read_inheritable_attribute('accept_api_auth_actions') || []
     end
   end
-  
+
   def accept_api_auth?(action=action_name)
     self.class.accept_api_auth.include?(action.to_sym)
   end
 
   # Returns the number of objects that should be displayed

     session.delete(:query)
     sort_clear if respond_to?(:sort_clear)
     render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
   end
 
-  # Converts the errors on an ActiveRecord object into a common JSON format
-  def object_errors_to_json(object)
-    object.errors.collect do |attribute, error|
-      { attribute => error }
-    end.to_json
-  end
-
   # Renders API response on validation failure
   def render_validation_errors(object)
     options = { :status => :unprocessable_entity, :layout => false }
     options.merge!(case params[:format]
       when 'xml';  { :xml =>  object.errors }