##// END OF EJS Templates
jro_apps » redmine
RSS
Sets forgery protection filter first....
Jean-Philippe Lang -
r6195:130b71d121f4
parent child
Show More
Side by Side Unified
Context file:
r6195:130b71d121f4 Loading diff...:
Show file before | Show file after | Hide comments
@@ -1,517 +1,518
1 # Redmine - project management software
1 # Redmine - project management software
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 #
3 #
4 # This program is free software; you can redistribute it and/or
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
7 # of the License, or (at your option) any later version.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU General Public License
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
17
18 require 'uri'
18 require 'uri'
19 require 'cgi'
19 require 'cgi'
20
20
21 class Unauthorized < Exception; end
21 class Unauthorized < Exception; end
22
22
23 class ApplicationController < ActionController::Base
23 class ApplicationController < ActionController::Base
24 include Redmine::I18n
24 include Redmine::I18n
25
25
26 layout 'base'
26 layout 'base'
27 exempt_from_layout 'builder', 'rsb'
27 exempt_from_layout 'builder', 'rsb'
28
29 protect_from_forgery
28
30
29 # Remove broken cookie after upgrade from 0.8.x (#4292)
31 # Remove broken cookie after upgrade from 0.8.x (#4292)
30 # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
32 # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
31 # TODO: remove it when Rails is fixed
33 # TODO: remove it when Rails is fixed
32 before_filter :delete_broken_cookies
34 before_filter :delete_broken_cookies
33 def delete_broken_cookies
35 def delete_broken_cookies
34 if cookies['_redmine_session'] && cookies['_redmine_session'] !~ /--/
36 if cookies['_redmine_session'] && cookies['_redmine_session'] !~ /--/
35 cookies.delete '_redmine_session'
37 cookies.delete '_redmine_session'
36 redirect_to home_path
38 redirect_to home_path
37 return false
39 return false
38 end
40 end
39 end
41 end
40
42
41 before_filter :user_setup, :check_if_login_required, :set_localization
43 before_filter :user_setup, :check_if_login_required, :set_localization
42 filter_parameter_logging :password
44 filter_parameter_logging :password
43 protect_from_forgery
44
45
45 rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
46 rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
46 rescue_from ::Unauthorized, :with => :deny_access
47 rescue_from ::Unauthorized, :with => :deny_access
47
48
48 include Redmine::Search::Controller
49 include Redmine::Search::Controller
49 include Redmine::MenuManager::MenuController
50 include Redmine::MenuManager::MenuController
50 helper Redmine::MenuManager::MenuHelper
51 helper Redmine::MenuManager::MenuHelper
51
52
52 Redmine::Scm::Base.all.each do |scm|
53 Redmine::Scm::Base.all.each do |scm|
53 require_dependency "repository/#{scm.underscore}"
54 require_dependency "repository/#{scm.underscore}"
54 end
55 end
55
56
56 def user_setup
57 def user_setup
57 # Check the settings cache for each request
58 # Check the settings cache for each request
58 Setting.check_cache
59 Setting.check_cache
59 # Find the current user
60 # Find the current user
60 User.current = find_current_user
61 User.current = find_current_user
61 end
62 end
62
63
63 # Returns the current user or nil if no user is logged in
64 # Returns the current user or nil if no user is logged in
64 # and starts a session if needed
65 # and starts a session if needed
65 def find_current_user
66 def find_current_user
66 if session[:user_id]
67 if session[:user_id]
67 # existing session
68 # existing session
68 (User.active.find(session[:user_id]) rescue nil)
69 (User.active.find(session[:user_id]) rescue nil)
69 elsif cookies[:autologin] && Setting.autologin?
70 elsif cookies[:autologin] && Setting.autologin?
70 # auto-login feature starts a new session
71 # auto-login feature starts a new session
71 user = User.try_to_autologin(cookies[:autologin])
72 user = User.try_to_autologin(cookies[:autologin])
72 session[:user_id] = user.id if user
73 session[:user_id] = user.id if user
73 user
74 user
74 elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
75 elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
75 # RSS key authentication does not start a session
76 # RSS key authentication does not start a session
76 User.find_by_rss_key(params[:key])
77 User.find_by_rss_key(params[:key])
77 elsif Setting.rest_api_enabled? && accept_api_auth?
78 elsif Setting.rest_api_enabled? && accept_api_auth?
78 if (key = api_key_from_request)
79 if (key = api_key_from_request)
79 # Use API key
80 # Use API key
80 User.find_by_api_key(key)
81 User.find_by_api_key(key)
81 else
82 else
82 # HTTP Basic, either username/password or API key/random
83 # HTTP Basic, either username/password or API key/random
83 authenticate_with_http_basic do |username, password|
84 authenticate_with_http_basic do |username, password|
84 User.try_to_login(username, password) || User.find_by_api_key(username)
85 User.try_to_login(username, password) || User.find_by_api_key(username)
85 end
86 end
86 end
87 end
87 end
88 end
88 end
89 end
89
90
90 # Sets the logged in user
91 # Sets the logged in user
91 def logged_user=(user)
92 def logged_user=(user)
92 reset_session
93 reset_session
93 if user && user.is_a?(User)
94 if user && user.is_a?(User)
94 User.current = user
95 User.current = user
95 session[:user_id] = user.id
96 session[:user_id] = user.id
96 else
97 else
97 User.current = User.anonymous
98 User.current = User.anonymous
98 end
99 end
99 end
100 end
100
101
101 # check if login is globally required to access the application
102 # check if login is globally required to access the application
102 def check_if_login_required
103 def check_if_login_required
103 # no check needed if user is already logged in
104 # no check needed if user is already logged in
104 return true if User.current.logged?
105 return true if User.current.logged?
105 require_login if Setting.login_required?
106 require_login if Setting.login_required?
106 end
107 end
107
108
108 def set_localization
109 def set_localization
109 lang = nil
110 lang = nil
110 if User.current.logged?
111 if User.current.logged?
111 lang = find_language(User.current.language)
112 lang = find_language(User.current.language)
112 end
113 end
113 if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
114 if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
114 accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
115 accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
115 if !accept_lang.blank?
116 if !accept_lang.blank?
116 accept_lang = accept_lang.downcase
117 accept_lang = accept_lang.downcase
117 lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
118 lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
118 end
119 end
119 end
120 end
120 lang ||= Setting.default_language
121 lang ||= Setting.default_language
121 set_language_if_valid(lang)
122 set_language_if_valid(lang)
122 end
123 end
123
124
124 def require_login
125 def require_login
125 if !User.current.logged?
126 if !User.current.logged?
126 # Extract only the basic url parameters on non-GET requests
127 # Extract only the basic url parameters on non-GET requests
127 if request.get?
128 if request.get?
128 url = url_for(params)
129 url = url_for(params)
129 else
130 else
130 url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
131 url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
131 end
132 end
132 respond_to do |format|
133 respond_to do |format|
133 format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
134 format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
134 format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
135 format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
135 format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
136 format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
136 format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
137 format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
137 format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
138 format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
138 end
139 end
139 return false
140 return false
140 end
141 end
141 true
142 true
142 end
143 end
143
144
144 def require_admin
145 def require_admin
145 return unless require_login
146 return unless require_login
146 if !User.current.admin?
147 if !User.current.admin?
147 render_403
148 render_403
148 return false
149 return false
149 end
150 end
150 true
151 true
151 end
152 end
152
153
153 def deny_access
154 def deny_access
154 User.current.logged? ? render_403 : require_login
155 User.current.logged? ? render_403 : require_login
155 end
156 end
156
157
157 # Authorize the user for the requested action
158 # Authorize the user for the requested action
158 def authorize(ctrl = params[:controller], action = params[:action], global = false)
159 def authorize(ctrl = params[:controller], action = params[:action], global = false)
159 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
160 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
160 if allowed
161 if allowed
161 true
162 true
162 else
163 else
163 if @project && @project.archived?
164 if @project && @project.archived?
164 render_403 :message => :notice_not_authorized_archived_project
165 render_403 :message => :notice_not_authorized_archived_project
165 else
166 else
166 deny_access
167 deny_access
167 end
168 end
168 end
169 end
169 end
170 end
170
171
171 # Authorize the user for the requested action outside a project
172 # Authorize the user for the requested action outside a project
172 def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
173 def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
173 authorize(ctrl, action, global)
174 authorize(ctrl, action, global)
174 end
175 end
175
176
176 # Find project of id params[:id]
177 # Find project of id params[:id]
177 def find_project
178 def find_project
178 @project = Project.find(params[:id])
179 @project = Project.find(params[:id])
179 rescue ActiveRecord::RecordNotFound
180 rescue ActiveRecord::RecordNotFound
180 render_404
181 render_404
181 end
182 end
182
183
183 # Find project of id params[:project_id]
184 # Find project of id params[:project_id]
184 def find_project_by_project_id
185 def find_project_by_project_id
185 @project = Project.find(params[:project_id])
186 @project = Project.find(params[:project_id])
186 rescue ActiveRecord::RecordNotFound
187 rescue ActiveRecord::RecordNotFound
187 render_404
188 render_404
188 end
189 end
189
190
190 # Find a project based on params[:project_id]
191 # Find a project based on params[:project_id]
191 # TODO: some subclasses override this, see about merging their logic
192 # TODO: some subclasses override this, see about merging their logic
192 def find_optional_project
193 def find_optional_project
193 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
194 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
194 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
195 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
195 allowed ? true : deny_access
196 allowed ? true : deny_access
196 rescue ActiveRecord::RecordNotFound
197 rescue ActiveRecord::RecordNotFound
197 render_404
198 render_404
198 end
199 end
199
200
200 # Finds and sets @project based on @object.project
201 # Finds and sets @project based on @object.project
201 def find_project_from_association
202 def find_project_from_association
202 render_404 unless @object.present?
203 render_404 unless @object.present?
203
204
204 @project = @object.project
205 @project = @object.project
205 rescue ActiveRecord::RecordNotFound
206 rescue ActiveRecord::RecordNotFound
206 render_404
207 render_404
207 end
208 end
208
209
209 def find_model_object
210 def find_model_object
210 model = self.class.read_inheritable_attribute('model_object')
211 model = self.class.read_inheritable_attribute('model_object')
211 if model
212 if model
212 @object = model.find(params[:id])
213 @object = model.find(params[:id])
213 self.instance_variable_set('@' + controller_name.singularize, @object) if @object
214 self.instance_variable_set('@' + controller_name.singularize, @object) if @object
214 end
215 end
215 rescue ActiveRecord::RecordNotFound
216 rescue ActiveRecord::RecordNotFound
216 render_404
217 render_404
217 end
218 end
218
219
219 def self.model_object(model)
220 def self.model_object(model)
220 write_inheritable_attribute('model_object', model)
221 write_inheritable_attribute('model_object', model)
221 end
222 end
222
223
223 # Filter for bulk issue operations
224 # Filter for bulk issue operations
224 def find_issues
225 def find_issues
225 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
226 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
226 raise ActiveRecord::RecordNotFound if @issues.empty?
227 raise ActiveRecord::RecordNotFound if @issues.empty?
227 if @issues.detect {|issue| !issue.visible?}
228 if @issues.detect {|issue| !issue.visible?}
228 deny_access
229 deny_access
229 return
230 return
230 end
231 end
231 @projects = @issues.collect(&:project).compact.uniq
232 @projects = @issues.collect(&:project).compact.uniq
232 @project = @projects.first if @projects.size == 1
233 @project = @projects.first if @projects.size == 1
233 rescue ActiveRecord::RecordNotFound
234 rescue ActiveRecord::RecordNotFound
234 render_404
235 render_404
235 end
236 end
236
237
237 # Check if project is unique before bulk operations
238 # Check if project is unique before bulk operations
238 def check_project_uniqueness
239 def check_project_uniqueness
239 unless @project
240 unless @project
240 # TODO: let users bulk edit/move/destroy issues from different projects
241 # TODO: let users bulk edit/move/destroy issues from different projects
241 render_error 'Can not bulk edit/move/destroy issues from different projects'
242 render_error 'Can not bulk edit/move/destroy issues from different projects'
242 return false
243 return false
243 end
244 end
244 end
245 end
245
246
246 # make sure that the user is a member of the project (or admin) if project is private
247 # make sure that the user is a member of the project (or admin) if project is private
247 # used as a before_filter for actions that do not require any particular permission on the project
248 # used as a before_filter for actions that do not require any particular permission on the project
248 def check_project_privacy
249 def check_project_privacy
249 if @project && @project.active?
250 if @project && @project.active?
250 if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
251 if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
251 true
252 true
252 else
253 else
253 User.current.logged? ? render_403 : require_login
254 User.current.logged? ? render_403 : require_login
254 end
255 end
255 else
256 else
256 @project = nil
257 @project = nil
257 render_404
258 render_404
258 false
259 false
259 end
260 end
260 end
261 end
261
262
262 def back_url
263 def back_url
263 params[:back_url] || request.env['HTTP_REFERER']
264 params[:back_url] || request.env['HTTP_REFERER']
264 end
265 end
265
266
266 def redirect_back_or_default(default)
267 def redirect_back_or_default(default)
267 back_url = CGI.unescape(params[:back_url].to_s)
268 back_url = CGI.unescape(params[:back_url].to_s)
268 if !back_url.blank?
269 if !back_url.blank?
269 begin
270 begin
270 uri = URI.parse(back_url)
271 uri = URI.parse(back_url)
271 # do not redirect user to another host or to the login or register page
272 # do not redirect user to another host or to the login or register page
272 if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
273 if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
273 redirect_to(back_url)
274 redirect_to(back_url)
274 return
275 return
275 end
276 end
276 rescue URI::InvalidURIError
277 rescue URI::InvalidURIError
277 # redirect to default
278 # redirect to default
278 end
279 end
279 end
280 end
280 redirect_to default
281 redirect_to default
281 false
282 false
282 end
283 end
283
284
284 def render_403(options={})
285 def render_403(options={})
285 @project = nil
286 @project = nil
286 render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
287 render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
287 return false
288 return false
288 end
289 end
289
290
290 def render_404(options={})
291 def render_404(options={})
291 render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
292 render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
292 return false
293 return false
293 end
294 end
294
295
295 # Renders an error response
296 # Renders an error response
296 def render_error(arg)
297 def render_error(arg)
297 arg = {:message => arg} unless arg.is_a?(Hash)
298 arg = {:message => arg} unless arg.is_a?(Hash)
298
299
299 @message = arg[:message]
300 @message = arg[:message]
300 @message = l(@message) if @message.is_a?(Symbol)
301 @message = l(@message) if @message.is_a?(Symbol)
301 @status = arg[:status] || 500
302 @status = arg[:status] || 500
302
303
303 respond_to do |format|
304 respond_to do |format|
304 format.html {
305 format.html {
305 render :template => 'common/error', :layout => use_layout, :status => @status
306 render :template => 'common/error', :layout => use_layout, :status => @status
306 }
307 }
307 format.atom { head @status }
308 format.atom { head @status }
308 format.xml { head @status }
309 format.xml { head @status }
309 format.js { head @status }
310 format.js { head @status }
310 format.json { head @status }
311 format.json { head @status }
311 end
312 end
312 end
313 end
313
314
314 # Picks which layout to use based on the request
315 # Picks which layout to use based on the request
315 #
316 #
316 # @return [boolean, string] name of the layout to use or false for no layout
317 # @return [boolean, string] name of the layout to use or false for no layout
317 def use_layout
318 def use_layout
318 request.xhr? ? false : 'base'
319 request.xhr? ? false : 'base'
319 end
320 end
320
321
321 def invalid_authenticity_token
322 def invalid_authenticity_token
322 if api_request?
323 if api_request?
323 logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
324 logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
324 end
325 end
325 render_error "Invalid form authenticity token."
326 render_error "Invalid form authenticity token."
326 end
327 end
327
328
328 def render_feed(items, options={})
329 def render_feed(items, options={})
329 @items = items || []
330 @items = items || []
330 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
331 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
331 @items = @items.slice(0, Setting.feeds_limit.to_i)
332 @items = @items.slice(0, Setting.feeds_limit.to_i)
332 @title = options[:title] || Setting.app_title
333 @title = options[:title] || Setting.app_title
333 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
334 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
334 end
335 end
335
336
336 # TODO: remove in Redmine 1.4
337 # TODO: remove in Redmine 1.4
337 def self.accept_key_auth(*actions)
338 def self.accept_key_auth(*actions)
338 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
339 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
339 accept_rss_auth(*actions)
340 accept_rss_auth(*actions)
340 end
341 end
341
342
342 # TODO: remove in Redmine 1.4
343 # TODO: remove in Redmine 1.4
343 def accept_key_auth_actions
344 def accept_key_auth_actions
344 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
345 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
345 self.class.accept_rss_auth
346 self.class.accept_rss_auth
346 end
347 end
347
348
348 def self.accept_rss_auth(*actions)
349 def self.accept_rss_auth(*actions)
349 if actions.any?
350 if actions.any?
350 write_inheritable_attribute('accept_rss_auth_actions', actions)
351 write_inheritable_attribute('accept_rss_auth_actions', actions)
351 else
352 else
352 read_inheritable_attribute('accept_rss_auth_actions') || []
353 read_inheritable_attribute('accept_rss_auth_actions') || []
353 end
354 end
354 end
355 end
355
356
356 def accept_rss_auth?(action=action_name)
357 def accept_rss_auth?(action=action_name)
357 self.class.accept_rss_auth.include?(action.to_sym)
358 self.class.accept_rss_auth.include?(action.to_sym)
358 end
359 end
359
360
360 def self.accept_api_auth(*actions)
361 def self.accept_api_auth(*actions)
361 if actions.any?
362 if actions.any?
362 write_inheritable_attribute('accept_api_auth_actions', actions)
363 write_inheritable_attribute('accept_api_auth_actions', actions)
363 else
364 else
364 read_inheritable_attribute('accept_api_auth_actions') || []
365 read_inheritable_attribute('accept_api_auth_actions') || []
365 end
366 end
366 end
367 end
367
368
368 def accept_api_auth?(action=action_name)
369 def accept_api_auth?(action=action_name)
369 self.class.accept_api_auth.include?(action.to_sym)
370 self.class.accept_api_auth.include?(action.to_sym)
370 end
371 end
371
372
372 # Returns the number of objects that should be displayed
373 # Returns the number of objects that should be displayed
373 # on the paginated list
374 # on the paginated list
374 def per_page_option
375 def per_page_option
375 per_page = nil
376 per_page = nil
376 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
377 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
377 per_page = params[:per_page].to_s.to_i
378 per_page = params[:per_page].to_s.to_i
378 session[:per_page] = per_page
379 session[:per_page] = per_page
379 elsif session[:per_page]
380 elsif session[:per_page]
380 per_page = session[:per_page]
381 per_page = session[:per_page]
381 else
382 else
382 per_page = Setting.per_page_options_array.first || 25
383 per_page = Setting.per_page_options_array.first || 25
383 end
384 end
384 per_page
385 per_page
385 end
386 end
386
387
387 # Returns offset and limit used to retrieve objects
388 # Returns offset and limit used to retrieve objects
388 # for an API response based on offset, limit and page parameters
389 # for an API response based on offset, limit and page parameters
389 def api_offset_and_limit(options=params)
390 def api_offset_and_limit(options=params)
390 if options[:offset].present?
391 if options[:offset].present?
391 offset = options[:offset].to_i
392 offset = options[:offset].to_i
392 if offset < 0
393 if offset < 0
393 offset = 0
394 offset = 0
394 end
395 end
395 end
396 end
396 limit = options[:limit].to_i
397 limit = options[:limit].to_i
397 if limit < 1
398 if limit < 1
398 limit = 25
399 limit = 25
399 elsif limit > 100
400 elsif limit > 100
400 limit = 100
401 limit = 100
401 end
402 end
402 if offset.nil? && options[:page].present?
403 if offset.nil? && options[:page].present?
403 offset = (options[:page].to_i - 1) * limit
404 offset = (options[:page].to_i - 1) * limit
404 offset = 0 if offset < 0
405 offset = 0 if offset < 0
405 end
406 end
406 offset ||= 0
407 offset ||= 0
407
408
408 [offset, limit]
409 [offset, limit]
409 end
410 end
410
411
411 # qvalues http header parser
412 # qvalues http header parser
412 # code taken from webrick
413 # code taken from webrick
413 def parse_qvalues(value)
414 def parse_qvalues(value)
414 tmp = []
415 tmp = []
415 if value
416 if value
416 parts = value.split(/,\s*/)
417 parts = value.split(/,\s*/)
417 parts.each {|part|
418 parts.each {|part|
418 if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
419 if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
419 val = m[1]
420 val = m[1]
420 q = (m[2] or 1).to_f
421 q = (m[2] or 1).to_f
421 tmp.push([val, q])
422 tmp.push([val, q])
422 end
423 end
423 }
424 }
424 tmp = tmp.sort_by{|val, q| -q}
425 tmp = tmp.sort_by{|val, q| -q}
425 tmp.collect!{|val, q| val}
426 tmp.collect!{|val, q| val}
426 end
427 end
427 return tmp
428 return tmp
428 rescue
429 rescue
429 nil
430 nil
430 end
431 end
431
432
432 # Returns a string that can be used as filename value in Content-Disposition header
433 # Returns a string that can be used as filename value in Content-Disposition header
433 def filename_for_content_disposition(name)
434 def filename_for_content_disposition(name)
434 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
435 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
435 end
436 end
436
437
437 def api_request?
438 def api_request?
438 %w(xml json).include? params[:format]
439 %w(xml json).include? params[:format]
439 end
440 end
440
441
441 # Returns the API key present in the request
442 # Returns the API key present in the request
442 def api_key_from_request
443 def api_key_from_request
443 if params[:key].present?
444 if params[:key].present?
444 params[:key]
445 params[:key]
445 elsif request.headers["X-Redmine-API-Key"].present?
446 elsif request.headers["X-Redmine-API-Key"].present?
446 request.headers["X-Redmine-API-Key"]
447 request.headers["X-Redmine-API-Key"]
447 end
448 end
448 end
449 end
449
450
450 # Renders a warning flash if obj has unsaved attachments
451 # Renders a warning flash if obj has unsaved attachments
451 def render_attachment_warning_if_needed(obj)
452 def render_attachment_warning_if_needed(obj)
452 flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
453 flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
453 end
454 end
454
455
455 # Sets the `flash` notice or error based the number of issues that did not save
456 # Sets the `flash` notice or error based the number of issues that did not save
456 #
457 #
457 # @param [Array, Issue] issues all of the saved and unsaved Issues
458 # @param [Array, Issue] issues all of the saved and unsaved Issues
458 # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
459 # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
459 def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
460 def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
460 if unsaved_issue_ids.empty?
461 if unsaved_issue_ids.empty?
461 flash[:notice] = l(:notice_successful_update) unless issues.empty?
462 flash[:notice] = l(:notice_successful_update) unless issues.empty?
462 else
463 else
463 flash[:error] = l(:notice_failed_to_save_issues,
464 flash[:error] = l(:notice_failed_to_save_issues,
464 :count => unsaved_issue_ids.size,
465 :count => unsaved_issue_ids.size,
465 :total => issues.size,
466 :total => issues.size,
466 :ids => '#' + unsaved_issue_ids.join(', #'))
467 :ids => '#' + unsaved_issue_ids.join(', #'))
467 end
468 end
468 end
469 end
469
470
470 # Rescues an invalid query statement. Just in case...
471 # Rescues an invalid query statement. Just in case...
471 def query_statement_invalid(exception)
472 def query_statement_invalid(exception)
472 logger.error "Query::StatementInvalid: #{exception.message}" if logger
473 logger.error "Query::StatementInvalid: #{exception.message}" if logger
473 session.delete(:query)
474 session.delete(:query)
474 sort_clear if respond_to?(:sort_clear)
475 sort_clear if respond_to?(:sort_clear)
475 render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
476 render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
476 end
477 end
477
478
478 # Converts the errors on an ActiveRecord object into a common JSON format
479 # Converts the errors on an ActiveRecord object into a common JSON format
479 def object_errors_to_json(object)
480 def object_errors_to_json(object)
480 object.errors.collect do |attribute, error|
481 object.errors.collect do |attribute, error|
481 { attribute => error }
482 { attribute => error }
482 end.to_json
483 end.to_json
483 end
484 end
484
485
485 # Renders API response on validation failure
486 # Renders API response on validation failure
486 def render_validation_errors(object)
487 def render_validation_errors(object)
487 options = { :status => :unprocessable_entity, :layout => false }
488 options = { :status => :unprocessable_entity, :layout => false }
488 options.merge!(case params[:format]
489 options.merge!(case params[:format]
489 when 'xml'; { :xml => object.errors }
490 when 'xml'; { :xml => object.errors }
490 when 'json'; { :json => {'errors' => object.errors} } # ActiveResource client compliance
491 when 'json'; { :json => {'errors' => object.errors} } # ActiveResource client compliance
491 else
492 else
492 raise "Unknown format #{params[:format]} in #render_validation_errors"
493 raise "Unknown format #{params[:format]} in #render_validation_errors"
493 end
494 end
494 )
495 )
495 render options
496 render options
496 end
497 end
497
498
498 # Overrides #default_template so that the api template
499 # Overrides #default_template so that the api template
499 # is used automatically if it exists
500 # is used automatically if it exists
500 def default_template(action_name = self.action_name)
501 def default_template(action_name = self.action_name)
501 if api_request?
502 if api_request?
502 begin
503 begin
503 return self.view_paths.find_template(default_template_name(action_name), 'api')
504 return self.view_paths.find_template(default_template_name(action_name), 'api')
504 rescue ::ActionView::MissingTemplate
505 rescue ::ActionView::MissingTemplate
505 # the api template was not found
506 # the api template was not found
506 # fallback to the default behaviour
507 # fallback to the default behaviour
507 end
508 end
508 end
509 end
509 super
510 super
510 end
511 end
511
512
512 # Overrides #pick_layout so that #render with no arguments
513 # Overrides #pick_layout so that #render with no arguments
513 # doesn't use the layout for api requests
514 # doesn't use the layout for api requests
514 def pick_layout(*args)
515 def pick_layout(*args)
515 api_request? ? nil : super
516 api_request? ? nil : super
516 end
517 end
517 end
518 end
General Comments 0
You need to be logged in to leave comments. Login now