##// END OF EJS Templates
jro_apps » redmine
RSS
Typo in api_key_auth deprecation code (#8773)....
Jean-Philippe Lang -
r6088:621850d5a04e
parent child
Show More
Side by Side Unified
Context file:
r6088:621850d5a04e Loading diff...:
Show file before | Show file after | Hide comments
@@ -1,517 +1,517
1 # Redmine - project management software
1 # Redmine - project management software
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 #
3 #
4 # This program is free software; you can redistribute it and/or
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
7 # of the License, or (at your option) any later version.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU General Public License
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
17
18 require 'uri'
18 require 'uri'
19 require 'cgi'
19 require 'cgi'
20
20
21 class Unauthorized < Exception; end
21 class Unauthorized < Exception; end
22
22
23 class ApplicationController < ActionController::Base
23 class ApplicationController < ActionController::Base
24 include Redmine::I18n
24 include Redmine::I18n
25
25
26 layout 'base'
26 layout 'base'
27 exempt_from_layout 'builder', 'rsb'
27 exempt_from_layout 'builder', 'rsb'
28
28
29 # Remove broken cookie after upgrade from 0.8.x (#4292)
29 # Remove broken cookie after upgrade from 0.8.x (#4292)
30 # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
30 # See https://rails.lighthouseapp.com/projects/8994/tickets/3360
31 # TODO: remove it when Rails is fixed
31 # TODO: remove it when Rails is fixed
32 before_filter :delete_broken_cookies
32 before_filter :delete_broken_cookies
33 def delete_broken_cookies
33 def delete_broken_cookies
34 if cookies['_redmine_session'] && cookies['_redmine_session'] !~ /--/
34 if cookies['_redmine_session'] && cookies['_redmine_session'] !~ /--/
35 cookies.delete '_redmine_session'
35 cookies.delete '_redmine_session'
36 redirect_to home_path
36 redirect_to home_path
37 return false
37 return false
38 end
38 end
39 end
39 end
40
40
41 before_filter :user_setup, :check_if_login_required, :set_localization
41 before_filter :user_setup, :check_if_login_required, :set_localization
42 filter_parameter_logging :password
42 filter_parameter_logging :password
43 protect_from_forgery
43 protect_from_forgery
44
44
45 rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
45 rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
46 rescue_from ::Unauthorized, :with => :deny_access
46 rescue_from ::Unauthorized, :with => :deny_access
47
47
48 include Redmine::Search::Controller
48 include Redmine::Search::Controller
49 include Redmine::MenuManager::MenuController
49 include Redmine::MenuManager::MenuController
50 helper Redmine::MenuManager::MenuHelper
50 helper Redmine::MenuManager::MenuHelper
51
51
52 Redmine::Scm::Base.all.each do |scm|
52 Redmine::Scm::Base.all.each do |scm|
53 require_dependency "repository/#{scm.underscore}"
53 require_dependency "repository/#{scm.underscore}"
54 end
54 end
55
55
56 def user_setup
56 def user_setup
57 # Check the settings cache for each request
57 # Check the settings cache for each request
58 Setting.check_cache
58 Setting.check_cache
59 # Find the current user
59 # Find the current user
60 User.current = find_current_user
60 User.current = find_current_user
61 end
61 end
62
62
63 # Returns the current user or nil if no user is logged in
63 # Returns the current user or nil if no user is logged in
64 # and starts a session if needed
64 # and starts a session if needed
65 def find_current_user
65 def find_current_user
66 if session[:user_id]
66 if session[:user_id]
67 # existing session
67 # existing session
68 (User.active.find(session[:user_id]) rescue nil)
68 (User.active.find(session[:user_id]) rescue nil)
69 elsif cookies[:autologin] && Setting.autologin?
69 elsif cookies[:autologin] && Setting.autologin?
70 # auto-login feature starts a new session
70 # auto-login feature starts a new session
71 user = User.try_to_autologin(cookies[:autologin])
71 user = User.try_to_autologin(cookies[:autologin])
72 session[:user_id] = user.id if user
72 session[:user_id] = user.id if user
73 user
73 user
74 elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
74 elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
75 # RSS key authentication does not start a session
75 # RSS key authentication does not start a session
76 User.find_by_rss_key(params[:key])
76 User.find_by_rss_key(params[:key])
77 elsif Setting.rest_api_enabled? && accept_api_auth?
77 elsif Setting.rest_api_enabled? && accept_api_auth?
78 if (key = api_key_from_request)
78 if (key = api_key_from_request)
79 # Use API key
79 # Use API key
80 User.find_by_api_key(key)
80 User.find_by_api_key(key)
81 else
81 else
82 # HTTP Basic, either username/password or API key/random
82 # HTTP Basic, either username/password or API key/random
83 authenticate_with_http_basic do |username, password|
83 authenticate_with_http_basic do |username, password|
84 User.try_to_login(username, password) || User.find_by_api_key(username)
84 User.try_to_login(username, password) || User.find_by_api_key(username)
85 end
85 end
86 end
86 end
87 end
87 end
88 end
88 end
89
89
90 # Sets the logged in user
90 # Sets the logged in user
91 def logged_user=(user)
91 def logged_user=(user)
92 reset_session
92 reset_session
93 if user && user.is_a?(User)
93 if user && user.is_a?(User)
94 User.current = user
94 User.current = user
95 session[:user_id] = user.id
95 session[:user_id] = user.id
96 else
96 else
97 User.current = User.anonymous
97 User.current = User.anonymous
98 end
98 end
99 end
99 end
100
100
101 # check if login is globally required to access the application
101 # check if login is globally required to access the application
102 def check_if_login_required
102 def check_if_login_required
103 # no check needed if user is already logged in
103 # no check needed if user is already logged in
104 return true if User.current.logged?
104 return true if User.current.logged?
105 require_login if Setting.login_required?
105 require_login if Setting.login_required?
106 end
106 end
107
107
108 def set_localization
108 def set_localization
109 lang = nil
109 lang = nil
110 if User.current.logged?
110 if User.current.logged?
111 lang = find_language(User.current.language)
111 lang = find_language(User.current.language)
112 end
112 end
113 if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
113 if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
114 accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
114 accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
115 if !accept_lang.blank?
115 if !accept_lang.blank?
116 accept_lang = accept_lang.downcase
116 accept_lang = accept_lang.downcase
117 lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
117 lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
118 end
118 end
119 end
119 end
120 lang ||= Setting.default_language
120 lang ||= Setting.default_language
121 set_language_if_valid(lang)
121 set_language_if_valid(lang)
122 end
122 end
123
123
124 def require_login
124 def require_login
125 if !User.current.logged?
125 if !User.current.logged?
126 # Extract only the basic url parameters on non-GET requests
126 # Extract only the basic url parameters on non-GET requests
127 if request.get?
127 if request.get?
128 url = url_for(params)
128 url = url_for(params)
129 else
129 else
130 url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
130 url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
131 end
131 end
132 respond_to do |format|
132 respond_to do |format|
133 format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
133 format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
134 format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
134 format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
135 format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
135 format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
136 format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
136 format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
137 format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
137 format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
138 end
138 end
139 return false
139 return false
140 end
140 end
141 true
141 true
142 end
142 end
143
143
144 def require_admin
144 def require_admin
145 return unless require_login
145 return unless require_login
146 if !User.current.admin?
146 if !User.current.admin?
147 render_403
147 render_403
148 return false
148 return false
149 end
149 end
150 true
150 true
151 end
151 end
152
152
153 def deny_access
153 def deny_access
154 User.current.logged? ? render_403 : require_login
154 User.current.logged? ? render_403 : require_login
155 end
155 end
156
156
157 # Authorize the user for the requested action
157 # Authorize the user for the requested action
158 def authorize(ctrl = params[:controller], action = params[:action], global = false)
158 def authorize(ctrl = params[:controller], action = params[:action], global = false)
159 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
159 allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
160 if allowed
160 if allowed
161 true
161 true
162 else
162 else
163 if @project && @project.archived?
163 if @project && @project.archived?
164 render_403 :message => :notice_not_authorized_archived_project
164 render_403 :message => :notice_not_authorized_archived_project
165 else
165 else
166 deny_access
166 deny_access
167 end
167 end
168 end
168 end
169 end
169 end
170
170
171 # Authorize the user for the requested action outside a project
171 # Authorize the user for the requested action outside a project
172 def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
172 def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
173 authorize(ctrl, action, global)
173 authorize(ctrl, action, global)
174 end
174 end
175
175
176 # Find project of id params[:id]
176 # Find project of id params[:id]
177 def find_project
177 def find_project
178 @project = Project.find(params[:id])
178 @project = Project.find(params[:id])
179 rescue ActiveRecord::RecordNotFound
179 rescue ActiveRecord::RecordNotFound
180 render_404
180 render_404
181 end
181 end
182
182
183 # Find project of id params[:project_id]
183 # Find project of id params[:project_id]
184 def find_project_by_project_id
184 def find_project_by_project_id
185 @project = Project.find(params[:project_id])
185 @project = Project.find(params[:project_id])
186 rescue ActiveRecord::RecordNotFound
186 rescue ActiveRecord::RecordNotFound
187 render_404
187 render_404
188 end
188 end
189
189
190 # Find a project based on params[:project_id]
190 # Find a project based on params[:project_id]
191 # TODO: some subclasses override this, see about merging their logic
191 # TODO: some subclasses override this, see about merging their logic
192 def find_optional_project
192 def find_optional_project
193 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
193 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
194 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
194 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
195 allowed ? true : deny_access
195 allowed ? true : deny_access
196 rescue ActiveRecord::RecordNotFound
196 rescue ActiveRecord::RecordNotFound
197 render_404
197 render_404
198 end
198 end
199
199
200 # Finds and sets @project based on @object.project
200 # Finds and sets @project based on @object.project
201 def find_project_from_association
201 def find_project_from_association
202 render_404 unless @object.present?
202 render_404 unless @object.present?
203
203
204 @project = @object.project
204 @project = @object.project
205 rescue ActiveRecord::RecordNotFound
205 rescue ActiveRecord::RecordNotFound
206 render_404
206 render_404
207 end
207 end
208
208
209 def find_model_object
209 def find_model_object
210 model = self.class.read_inheritable_attribute('model_object')
210 model = self.class.read_inheritable_attribute('model_object')
211 if model
211 if model
212 @object = model.find(params[:id])
212 @object = model.find(params[:id])
213 self.instance_variable_set('@' + controller_name.singularize, @object) if @object
213 self.instance_variable_set('@' + controller_name.singularize, @object) if @object
214 end
214 end
215 rescue ActiveRecord::RecordNotFound
215 rescue ActiveRecord::RecordNotFound
216 render_404
216 render_404
217 end
217 end
218
218
219 def self.model_object(model)
219 def self.model_object(model)
220 write_inheritable_attribute('model_object', model)
220 write_inheritable_attribute('model_object', model)
221 end
221 end
222
222
223 # Filter for bulk issue operations
223 # Filter for bulk issue operations
224 def find_issues
224 def find_issues
225 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
225 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
226 raise ActiveRecord::RecordNotFound if @issues.empty?
226 raise ActiveRecord::RecordNotFound if @issues.empty?
227 if @issues.detect {|issue| !issue.visible?}
227 if @issues.detect {|issue| !issue.visible?}
228 deny_access
228 deny_access
229 return
229 return
230 end
230 end
231 @projects = @issues.collect(&:project).compact.uniq
231 @projects = @issues.collect(&:project).compact.uniq
232 @project = @projects.first if @projects.size == 1
232 @project = @projects.first if @projects.size == 1
233 rescue ActiveRecord::RecordNotFound
233 rescue ActiveRecord::RecordNotFound
234 render_404
234 render_404
235 end
235 end
236
236
237 # Check if project is unique before bulk operations
237 # Check if project is unique before bulk operations
238 def check_project_uniqueness
238 def check_project_uniqueness
239 unless @project
239 unless @project
240 # TODO: let users bulk edit/move/destroy issues from different projects
240 # TODO: let users bulk edit/move/destroy issues from different projects
241 render_error 'Can not bulk edit/move/destroy issues from different projects'
241 render_error 'Can not bulk edit/move/destroy issues from different projects'
242 return false
242 return false
243 end
243 end
244 end
244 end
245
245
246 # make sure that the user is a member of the project (or admin) if project is private
246 # make sure that the user is a member of the project (or admin) if project is private
247 # used as a before_filter for actions that do not require any particular permission on the project
247 # used as a before_filter for actions that do not require any particular permission on the project
248 def check_project_privacy
248 def check_project_privacy
249 if @project && @project.active?
249 if @project && @project.active?
250 if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
250 if @project.is_public? || User.current.member_of?(@project) || User.current.admin?
251 true
251 true
252 else
252 else
253 User.current.logged? ? render_403 : require_login
253 User.current.logged? ? render_403 : require_login
254 end
254 end
255 else
255 else
256 @project = nil
256 @project = nil
257 render_404
257 render_404
258 false
258 false
259 end
259 end
260 end
260 end
261
261
262 def back_url
262 def back_url
263 params[:back_url] || request.env['HTTP_REFERER']
263 params[:back_url] || request.env['HTTP_REFERER']
264 end
264 end
265
265
266 def redirect_back_or_default(default)
266 def redirect_back_or_default(default)
267 back_url = CGI.unescape(params[:back_url].to_s)
267 back_url = CGI.unescape(params[:back_url].to_s)
268 if !back_url.blank?
268 if !back_url.blank?
269 begin
269 begin
270 uri = URI.parse(back_url)
270 uri = URI.parse(back_url)
271 # do not redirect user to another host or to the login or register page
271 # do not redirect user to another host or to the login or register page
272 if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
272 if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
273 redirect_to(back_url)
273 redirect_to(back_url)
274 return
274 return
275 end
275 end
276 rescue URI::InvalidURIError
276 rescue URI::InvalidURIError
277 # redirect to default
277 # redirect to default
278 end
278 end
279 end
279 end
280 redirect_to default
280 redirect_to default
281 false
281 false
282 end
282 end
283
283
284 def render_403(options={})
284 def render_403(options={})
285 @project = nil
285 @project = nil
286 render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
286 render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
287 return false
287 return false
288 end
288 end
289
289
290 def render_404(options={})
290 def render_404(options={})
291 render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
291 render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
292 return false
292 return false
293 end
293 end
294
294
295 # Renders an error response
295 # Renders an error response
296 def render_error(arg)
296 def render_error(arg)
297 arg = {:message => arg} unless arg.is_a?(Hash)
297 arg = {:message => arg} unless arg.is_a?(Hash)
298
298
299 @message = arg[:message]
299 @message = arg[:message]
300 @message = l(@message) if @message.is_a?(Symbol)
300 @message = l(@message) if @message.is_a?(Symbol)
301 @status = arg[:status] || 500
301 @status = arg[:status] || 500
302
302
303 respond_to do |format|
303 respond_to do |format|
304 format.html {
304 format.html {
305 render :template => 'common/error', :layout => use_layout, :status => @status
305 render :template => 'common/error', :layout => use_layout, :status => @status
306 }
306 }
307 format.atom { head @status }
307 format.atom { head @status }
308 format.xml { head @status }
308 format.xml { head @status }
309 format.js { head @status }
309 format.js { head @status }
310 format.json { head @status }
310 format.json { head @status }
311 end
311 end
312 end
312 end
313
313
314 # Picks which layout to use based on the request
314 # Picks which layout to use based on the request
315 #
315 #
316 # @return [boolean, string] name of the layout to use or false for no layout
316 # @return [boolean, string] name of the layout to use or false for no layout
317 def use_layout
317 def use_layout
318 request.xhr? ? false : 'base'
318 request.xhr? ? false : 'base'
319 end
319 end
320
320
321 def invalid_authenticity_token
321 def invalid_authenticity_token
322 if api_request?
322 if api_request?
323 logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
323 logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
324 end
324 end
325 render_error "Invalid form authenticity token."
325 render_error "Invalid form authenticity token."
326 end
326 end
327
327
328 def render_feed(items, options={})
328 def render_feed(items, options={})
329 @items = items || []
329 @items = items || []
330 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
330 @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
331 @items = @items.slice(0, Setting.feeds_limit.to_i)
331 @items = @items.slice(0, Setting.feeds_limit.to_i)
332 @title = options[:title] || Setting.app_title
332 @title = options[:title] || Setting.app_title
333 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
333 render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
334 end
334 end
335
335
336 # TODO: remove in Redmine 1.4
336 # TODO: remove in Redmine 1.4
337 def self.accept_key_auth(*actions)
337 def self.accept_key_auth(*actions)
338 ActiveSupport::Deprecaction.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
338 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
339 accept_rss_auth(*actions)
339 accept_rss_auth(*actions)
340 end
340 end
341
341
342 # TODO: remove in Redmine 1.4
342 # TODO: remove in Redmine 1.4
343 def accept_key_auth_actions
343 def accept_key_auth_actions
344 ActiveSupport::Deprecaction.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
344 ActiveSupport::Deprecation.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
345 self.class.accept_rss_auth
345 self.class.accept_rss_auth
346 end
346 end
347
347
348 def self.accept_rss_auth(*actions)
348 def self.accept_rss_auth(*actions)
349 if actions.any?
349 if actions.any?
350 write_inheritable_attribute('accept_rss_auth_actions', actions)
350 write_inheritable_attribute('accept_rss_auth_actions', actions)
351 else
351 else
352 read_inheritable_attribute('accept_rss_auth_actions') || []
352 read_inheritable_attribute('accept_rss_auth_actions') || []
353 end
353 end
354 end
354 end
355
355
356 def accept_rss_auth?(action=action_name)
356 def accept_rss_auth?(action=action_name)
357 self.class.accept_rss_auth.include?(action.to_sym)
357 self.class.accept_rss_auth.include?(action.to_sym)
358 end
358 end
359
359
360 def self.accept_api_auth(*actions)
360 def self.accept_api_auth(*actions)
361 if actions.any?
361 if actions.any?
362 write_inheritable_attribute('accept_api_auth_actions', actions)
362 write_inheritable_attribute('accept_api_auth_actions', actions)
363 else
363 else
364 read_inheritable_attribute('accept_api_auth_actions') || []
364 read_inheritable_attribute('accept_api_auth_actions') || []
365 end
365 end
366 end
366 end
367
367
368 def accept_api_auth?(action=action_name)
368 def accept_api_auth?(action=action_name)
369 self.class.accept_api_auth.include?(action.to_sym)
369 self.class.accept_api_auth.include?(action.to_sym)
370 end
370 end
371
371
372 # Returns the number of objects that should be displayed
372 # Returns the number of objects that should be displayed
373 # on the paginated list
373 # on the paginated list
374 def per_page_option
374 def per_page_option
375 per_page = nil
375 per_page = nil
376 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
376 if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
377 per_page = params[:per_page].to_s.to_i
377 per_page = params[:per_page].to_s.to_i
378 session[:per_page] = per_page
378 session[:per_page] = per_page
379 elsif session[:per_page]
379 elsif session[:per_page]
380 per_page = session[:per_page]
380 per_page = session[:per_page]
381 else
381 else
382 per_page = Setting.per_page_options_array.first || 25
382 per_page = Setting.per_page_options_array.first || 25
383 end
383 end
384 per_page
384 per_page
385 end
385 end
386
386
387 # Returns offset and limit used to retrieve objects
387 # Returns offset and limit used to retrieve objects
388 # for an API response based on offset, limit and page parameters
388 # for an API response based on offset, limit and page parameters
389 def api_offset_and_limit(options=params)
389 def api_offset_and_limit(options=params)
390 if options[:offset].present?
390 if options[:offset].present?
391 offset = options[:offset].to_i
391 offset = options[:offset].to_i
392 if offset < 0
392 if offset < 0
393 offset = 0
393 offset = 0
394 end
394 end
395 end
395 end
396 limit = options[:limit].to_i
396 limit = options[:limit].to_i
397 if limit < 1
397 if limit < 1
398 limit = 25
398 limit = 25
399 elsif limit > 100
399 elsif limit > 100
400 limit = 100
400 limit = 100
401 end
401 end
402 if offset.nil? && options[:page].present?
402 if offset.nil? && options[:page].present?
403 offset = (options[:page].to_i - 1) * limit
403 offset = (options[:page].to_i - 1) * limit
404 offset = 0 if offset < 0
404 offset = 0 if offset < 0
405 end
405 end
406 offset ||= 0
406 offset ||= 0
407
407
408 [offset, limit]
408 [offset, limit]
409 end
409 end
410
410
411 # qvalues http header parser
411 # qvalues http header parser
412 # code taken from webrick
412 # code taken from webrick
413 def parse_qvalues(value)
413 def parse_qvalues(value)
414 tmp = []
414 tmp = []
415 if value
415 if value
416 parts = value.split(/,\s*/)
416 parts = value.split(/,\s*/)
417 parts.each {|part|
417 parts.each {|part|
418 if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
418 if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
419 val = m[1]
419 val = m[1]
420 q = (m[2] or 1).to_f
420 q = (m[2] or 1).to_f
421 tmp.push([val, q])
421 tmp.push([val, q])
422 end
422 end
423 }
423 }
424 tmp = tmp.sort_by{|val, q| -q}
424 tmp = tmp.sort_by{|val, q| -q}
425 tmp.collect!{|val, q| val}
425 tmp.collect!{|val, q| val}
426 end
426 end
427 return tmp
427 return tmp
428 rescue
428 rescue
429 nil
429 nil
430 end
430 end
431
431
432 # Returns a string that can be used as filename value in Content-Disposition header
432 # Returns a string that can be used as filename value in Content-Disposition header
433 def filename_for_content_disposition(name)
433 def filename_for_content_disposition(name)
434 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
434 request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
435 end
435 end
436
436
437 def api_request?
437 def api_request?
438 %w(xml json).include? params[:format]
438 %w(xml json).include? params[:format]
439 end
439 end
440
440
441 # Returns the API key present in the request
441 # Returns the API key present in the request
442 def api_key_from_request
442 def api_key_from_request
443 if params[:key].present?
443 if params[:key].present?
444 params[:key]
444 params[:key]
445 elsif request.headers["X-Redmine-API-Key"].present?
445 elsif request.headers["X-Redmine-API-Key"].present?
446 request.headers["X-Redmine-API-Key"]
446 request.headers["X-Redmine-API-Key"]
447 end
447 end
448 end
448 end
449
449
450 # Renders a warning flash if obj has unsaved attachments
450 # Renders a warning flash if obj has unsaved attachments
451 def render_attachment_warning_if_needed(obj)
451 def render_attachment_warning_if_needed(obj)
452 flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
452 flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
453 end
453 end
454
454
455 # Sets the `flash` notice or error based the number of issues that did not save
455 # Sets the `flash` notice or error based the number of issues that did not save
456 #
456 #
457 # @param [Array, Issue] issues all of the saved and unsaved Issues
457 # @param [Array, Issue] issues all of the saved and unsaved Issues
458 # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
458 # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
459 def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
459 def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
460 if unsaved_issue_ids.empty?
460 if unsaved_issue_ids.empty?
461 flash[:notice] = l(:notice_successful_update) unless issues.empty?
461 flash[:notice] = l(:notice_successful_update) unless issues.empty?
462 else
462 else
463 flash[:error] = l(:notice_failed_to_save_issues,
463 flash[:error] = l(:notice_failed_to_save_issues,
464 :count => unsaved_issue_ids.size,
464 :count => unsaved_issue_ids.size,
465 :total => issues.size,
465 :total => issues.size,
466 :ids => '#' + unsaved_issue_ids.join(', #'))
466 :ids => '#' + unsaved_issue_ids.join(', #'))
467 end
467 end
468 end
468 end
469
469
470 # Rescues an invalid query statement. Just in case...
470 # Rescues an invalid query statement. Just in case...
471 def query_statement_invalid(exception)
471 def query_statement_invalid(exception)
472 logger.error "Query::StatementInvalid: #{exception.message}" if logger
472 logger.error "Query::StatementInvalid: #{exception.message}" if logger
473 session.delete(:query)
473 session.delete(:query)
474 sort_clear if respond_to?(:sort_clear)
474 sort_clear if respond_to?(:sort_clear)
475 render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
475 render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
476 end
476 end
477
477
478 # Converts the errors on an ActiveRecord object into a common JSON format
478 # Converts the errors on an ActiveRecord object into a common JSON format
479 def object_errors_to_json(object)
479 def object_errors_to_json(object)
480 object.errors.collect do |attribute, error|
480 object.errors.collect do |attribute, error|
481 { attribute => error }
481 { attribute => error }
482 end.to_json
482 end.to_json
483 end
483 end
484
484
485 # Renders API response on validation failure
485 # Renders API response on validation failure
486 def render_validation_errors(object)
486 def render_validation_errors(object)
487 options = { :status => :unprocessable_entity, :layout => false }
487 options = { :status => :unprocessable_entity, :layout => false }
488 options.merge!(case params[:format]
488 options.merge!(case params[:format]
489 when 'xml'; { :xml => object.errors }
489 when 'xml'; { :xml => object.errors }
490 when 'json'; { :json => {'errors' => object.errors} } # ActiveResource client compliance
490 when 'json'; { :json => {'errors' => object.errors} } # ActiveResource client compliance
491 else
491 else
492 raise "Unknown format #{params[:format]} in #render_validation_errors"
492 raise "Unknown format #{params[:format]} in #render_validation_errors"
493 end
493 end
494 )
494 )
495 render options
495 render options
496 end
496 end
497
497
498 # Overrides #default_template so that the api template
498 # Overrides #default_template so that the api template
499 # is used automatically if it exists
499 # is used automatically if it exists
500 def default_template(action_name = self.action_name)
500 def default_template(action_name = self.action_name)
501 if api_request?
501 if api_request?
502 begin
502 begin
503 return self.view_paths.find_template(default_template_name(action_name), 'api')
503 return self.view_paths.find_template(default_template_name(action_name), 'api')
504 rescue ::ActionView::MissingTemplate
504 rescue ::ActionView::MissingTemplate
505 # the api template was not found
505 # the api template was not found
506 # fallback to the default behaviour
506 # fallback to the default behaviour
507 end
507 end
508 end
508 end
509 super
509 super
510 end
510 end
511
511
512 # Overrides #pick_layout so that #render with no arguments
512 # Overrides #pick_layout so that #render with no arguments
513 # doesn't use the layout for api requests
513 # doesn't use the layout for api requests
514 def pick_layout(*args)
514 def pick_layout(*args)
515 api_request? ? nil : super
515 api_request? ? nil : super
516 end
516 end
517 end
517 end
General Comments 0
You need to be logged in to leave comments. Login now