Separation of RSS/API auth actions.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6197 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/activities_controller.rb b/app/controllers/activities_controller.rb
index cd03432b21fd4bda8e8e7577585392ed5b30a3b6..bdf0b24ed3b6d0c05e6733d3ee73e852b496a78d 100644 (file)
--- a/app/controllers/activities_controller.rb
+++ b/app/controllers/activities_controller.rb
@@ -1,7 +1,24 @@
+# Redmine - project management software
+# Copyright (C) 2006-2011  Jean-Philippe Lang
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
 class ActivitiesController < ApplicationController
   menu_item :activity
   before_filter :find_optional_project
-  accept_key_auth :index
+  accept_rss_auth :index
 
   def index
     @days = Setting.activity_days_default.to_i

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index e23f8b10892b85c3dffed267219aa8ef1f10acac..b3f00815d7e1ebed47c9d5b322b093d79d4780a6 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -71,11 +71,11 @@ class ApplicationController < ActionController::Base
       user = User.try_to_autologin(cookies[:autologin])
       session[:user_id] = user.id if user
       user
-    elsif params[:format] == 'atom' && request.get? && params[:key] && accept_key_auth_actions.include?(params[:action])
+    elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
       # RSS key authentication does not start a session
       User.find_by_rss_key(params[:key])
-    elsif Setting.rest_api_enabled? && api_request?
-      if (key = api_key_from_request) && accept_key_auth_actions.include?(params[:action])
+    elsif Setting.rest_api_enabled? && accept_api_auth?
+      if (key = api_key_from_request)
         # Use API key
         User.find_by_api_key(key)
       else
@@ -332,14 +332,41 @@ class ApplicationController < ActionController::Base
     @title = options[:title] || Setting.app_title
     render :template => "common/feed.atom.rxml", :layout => false, :content_type => 'application/atom+xml'
   end
-
+  
+  # TODO: remove in Redmine 1.4
   def self.accept_key_auth(*actions)
-    actions = actions.flatten.map(&:to_s)
-    write_inheritable_attribute('accept_key_auth_actions', actions)
+    ActiveSupport::Deprecaction.warn "ApplicationController.accept_key_auth is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
+    accept_rss_auth(*actions)
   end
 
+  # TODO: remove in Redmine 1.4
   def accept_key_auth_actions
-    self.class.read_inheritable_attribute('accept_key_auth_actions') || []
+    ActiveSupport::Deprecaction.warn "ApplicationController.accept_key_auth_actions is deprecated and will be removed in Redmine 1.4. Use accept_rss_auth (or accept_api_auth) instead."
+    self.class.accept_rss_auth
+  end
+  
+  def self.accept_rss_auth(*actions)
+    if actions.any?
+      write_inheritable_attribute('accept_rss_auth_actions', actions)
+    else
+      read_inheritable_attribute('accept_rss_auth_actions') || []
+    end
+  end
+  
+  def accept_rss_auth?(action=action_name)
+    self.class.accept_rss_auth.include?(action.to_sym)
+  end
+  
+  def self.accept_api_auth(*actions)
+    if actions.any?
+      write_inheritable_attribute('accept_api_auth_actions', actions)
+    else
+      read_inheritable_attribute('accept_api_auth_actions') || []
+    end
+  end
+  
+  def accept_api_auth?(action=action_name)
+    self.class.accept_api_auth.include?(action.to_sym)
   end
 
   # Returns the number of objects that should be displayed

diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb
index fa82218de307ff26522fb2c76c4b2674bee57ad3..6ad41e5620e4bce2e0c13716d33bb9471fec5817 100644 (file)
--- a/app/controllers/boards_controller.rb
+++ b/app/controllers/boards_controller.rb
@@ -1,5 +1,5 @@
-# redMine - project management software
-# Copyright (C) 2006-2007  Jean-Philippe Lang
+# Redmine - project management software
+# Copyright (C) 2006-2011  Jean-Philippe Lang
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
@@ -18,7 +18,7 @@
 class BoardsController < ApplicationController
   default_search_scope :messages
   before_filter :find_project, :find_board_if_available, :authorize
-  accept_key_auth :index, :show
+  accept_rss_auth :index, :show
 
   helper :messages
   include MessagesHelper

diff --git a/app/controllers/issue_relations_controller.rb b/app/controllers/issue_relations_controller.rb
index 9a17546743c2f1b7ce9c180328f1fd8a312231d7..383e748afe44b0b6fdd2ff1ff3ab49a5eb8e1542 100644 (file)
--- a/app/controllers/issue_relations_controller.rb
+++ b/app/controllers/issue_relations_controller.rb
@@ -19,7 +19,7 @@ class IssueRelationsController < ApplicationController
   before_filter :find_issue, :find_project_from_association, :authorize, :only => [:index, :create]
   before_filter :find_relation, :except => [:index, :create]
   
-  accept_key_auth :index, :show, :create, :destroy
+  accept_api_auth :index, :show, :create, :destroy
   
   def index
     @relations = @issue.relations

diff --git a/app/controllers/issues_controller.rb b/app/controllers/issues_controller.rb
index 648848e9b0d500a840d269498c02631809e666d7..00a999dce33e4c812ba563ea32820f4087df6de7 100644 (file)
--- a/app/controllers/issues_controller.rb
+++ b/app/controllers/issues_controller.rb
@@ -27,7 +27,8 @@ class IssuesController < ApplicationController
   before_filter :find_optional_project, :only => [:index]
   before_filter :check_for_default_issue_status, :only => [:new, :create]
   before_filter :build_new_issue_from_params, :only => [:new, :create]
-  accept_key_auth :index, :show, :create, :update, :destroy
+  accept_rss_auth :index, :show
+  accept_api_auth :index, :show, :create, :update, :destroy
 
   rescue_from Query::StatementInvalid, :with => :query_statement_invalid
 

diff --git a/app/controllers/journals_controller.rb b/app/controllers/journals_controller.rb
index 9eed2eacac043147ae62116db5b6e29ab68870fe..461598e26debdb9217639cab0aac84d1dcc450dc 100644 (file)
--- a/app/controllers/journals_controller.rb
+++ b/app/controllers/journals_controller.rb
@@ -20,7 +20,7 @@ class JournalsController < ApplicationController
   before_filter :find_issue, :only => [:new]
   before_filter :find_optional_project, :only => [:index]
   before_filter :authorize, :only => [:new, :edit, :diff]
-  accept_key_auth :index
+  accept_rss_auth :index
   menu_item :issues
   
   helper :issues

diff --git a/app/controllers/news_controller.rb b/app/controllers/news_controller.rb
index bc7eabb58c686fe583d77ad7999ed6f952cab962..7dbd80a57f90826003d6382a133acbc2946d92c2 100644 (file)
--- a/app/controllers/news_controller.rb
+++ b/app/controllers/news_controller.rb
@@ -23,7 +23,8 @@ class NewsController < ApplicationController
   before_filter :find_project, :only => [:new, :create]
   before_filter :authorize, :except => [:index]
   before_filter :find_optional_project, :only => :index
-  accept_key_auth :index
+  accept_rss_auth :index
+  accept_api_auth :index
   
   helper :watchers
   

diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 8579d0a80be8d211f2ebb16cf41597e348ffc6e5..4b750dc0e3719dc3a8070a24317ed093674729eb 100644 (file)
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -24,7 +24,8 @@ class ProjectsController < ApplicationController
   before_filter :authorize, :except => [ :index, :list, :new, :create, :copy, :archive, :unarchive, :destroy]
   before_filter :authorize_global, :only => [:new, :create]
   before_filter :require_admin, :only => [ :copy, :archive, :unarchive, :destroy ]
-  accept_key_auth :index, :show, :create, :update, :destroy
+  accept_rss_auth :index
+  accept_api_auth :index, :show, :create, :update, :destroy
 
   after_filter :only => [:create, :edit, :update, :archive, :unarchive, :destroy] do |controller|
     if controller.request.post?

diff --git a/app/controllers/queries_controller.rb b/app/controllers/queries_controller.rb
index 601ad85d15c9b62e1b0c7390c95e42c5b65e961c..f8bc05f8429c69e81ea098acc869f57bafc340bc 100644 (file)
--- a/app/controllers/queries_controller.rb
+++ b/app/controllers/queries_controller.rb
@@ -20,7 +20,7 @@ class QueriesController < ApplicationController
   before_filter :find_query, :except => [:new, :index]
   before_filter :find_optional_project, :only => :new
   
-  accept_key_auth :index
+  accept_api_auth :index
   
   def index
     case params[:format]

diff --git a/app/controllers/repositories_controller.rb b/app/controllers/repositories_controller.rb
index a30353eb9e448cfe79b806220caef753a22738cb..eef8560325cf487d143faa12bcede78279dddc57 100644 (file)
--- a/app/controllers/repositories_controller.rb
+++ b/app/controllers/repositories_controller.rb
@@ -30,7 +30,7 @@ class RepositoriesController < ApplicationController
   before_filter :find_repository, :except => :edit
   before_filter :find_project, :only => :edit
   before_filter :authorize
-  accept_key_auth :revisions
+  accept_rss_auth :revisions
 
   rescue_from Redmine::Scm::Adapters::CommandFailed, :with => :show_error_command_failed
 

diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb
index 16e6e2457626ccec7d594a14f34905d0074f125d..ccd170158ea9621ff08106578f9c6b68205895a2 100644 (file)
--- a/app/controllers/timelog_controller.rb
+++ b/app/controllers/timelog_controller.rb
@@ -1,5 +1,5 @@
 # Redmine - project management software
-# Copyright (C) 2006-2010  Jean-Philippe Lang
+# Copyright (C) 2006-2011  Jean-Philippe Lang
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
@@ -22,7 +22,8 @@ class TimelogController < ApplicationController
   before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]
   before_filter :authorize, :except => [:index]
   before_filter :find_optional_project, :only => [:index]
-  accept_key_auth :index, :show, :create, :update, :destroy
+  accept_rss_auth :index
+  accept_api_auth :index, :show, :create, :update, :destroy
   
   helper :sort
   include SortHelper

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index dc991c59d31e96ef1f89f152d0e3777b08cf24a5..40a9ee427a3a18b31f489ad45b65e04455d7b359 100644 (file)
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -20,7 +20,7 @@ class UsersController < ApplicationController
   
   before_filter :require_admin, :except => :show
   before_filter :find_user, :only => [:show, :edit, :update, :destroy, :edit_membership, :destroy_membership]
-  accept_key_auth :index, :show, :create, :update, :destroy
+  accept_api_auth :index, :show, :create, :update, :destroy
 
   helper :sort
   include SortHelper

diff --git a/app/controllers/versions_controller.rb b/app/controllers/versions_controller.rb
index 030f03c7874e9e6107579588075c071fddc6efea..0c41355814863e0ccb737907c1ba546f5fa08047 100644 (file)
--- a/app/controllers/versions_controller.rb
+++ b/app/controllers/versions_controller.rb
@@ -23,7 +23,7 @@ class VersionsController < ApplicationController
   before_filter :find_project, :only => [:index, :new, :create, :close_completed]
   before_filter :authorize
 
-  accept_key_auth :index, :create, :update, :destroy
+  accept_api_auth :index, :create, :update, :destroy
   
   helper :custom_fields
   helper :projects