1 files changed, 33 insertions, 10 deletions
diff --git a/app/controllers/issue_relations_controller.rb b/app/controllers/issue_relations_controller.rb
index b095df37a..094036768 100644
--- a/app/controllers/issue_relations_controller.rb
+++ b/app/controllers/issue_relations_controller.rb
@@ -1,5 +1,5 @@
-# redMine - project management software
-# Copyright (C) 2006-2007  Jean-Philippe Lang
+# Redmine - project management software
+# Copyright (C) 2006-2011  Jean-Philippe Lang
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
@@ -17,14 +17,28 @@
 
 class IssueRelationsController < ApplicationController
   before_filter :find_issue, :find_project_from_association, :authorize
+  accept_key_auth :show, :create, :destroy
   
-  def new
+  def show
+    @relation = @issue.find_relation(params[:id])
+
+    respond_to do |format|
+      format.html { render :nothing => true }
+      format.api
+    end
+  rescue ActiveRecord::RecordNotFound
+    render_404
+  end
+  
+  verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
+  def create
     @relation = IssueRelation.new(params[:relation])
     @relation.issue_from = @issue
     if params[:relation] && m = params[:relation][:issue_to_id].to_s.match(/^#?(\d+)$/)
       @relation.issue_to = Issue.visible.find_by_id(m[1].to_i)
     end
-    @relation.save if request.post?
+    saved = @relation.save
+    
     respond_to do |format|
       format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
       format.js do
@@ -37,22 +51,31 @@ class IssueRelationsController < ApplicationController
           end
         end
       end
+      format.api { 
+        if saved
+          render :action => 'show', :status => :created, :location => issue_relation_url(@issue, @relation)
+        else
+          render_validation_errors(@relation)
+        end
+      }
     end
   end
   
+  verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
   def destroy
-    relation = IssueRelation.find(params[:id])
-    if request.post? && @issue.relations.include?(relation)
-      relation.destroy
-      @issue.reload
-    end
+    relation = @issue.find_relation(params[:id])
+    relation.destroy
+    
     respond_to do |format|
       format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
       format.js {
-        @relations = @issue.relations.select {|r| r.other_issue(@issue) && r.other_issue(@issue).visible? }
+        @relations = @issue.reload.relations.select {|r| r.other_issue(@issue) && r.other_issue(@issue).visible? }
         render(:update) {|page| page.replace_html "relations", :partial => 'issues/relations'}
       }
+      format.api { head :ok }
     end
+  rescue ActiveRecord::RecordNotFound
+    render_404
   end
   
 private