Merge branch 'master' of git.workaround.org:chaas/debshots

app/controllers/application_controller.rb

@@ -3,15 +3,6 @@ class ApplicationController < ActionController::Base
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 
-  before_filter :create_user_token
-
   # Do not mention passwords in the log file
   # filter_parameter_logging :password
-
-  # Assign the visitor a unique hash so that we can track their uploads
-  # and show them even before moderation.
-  def create_user_token
-    session[:token] ||= SecureRandom.hex
-    session[:ip] ||= request.remote_ip
-  end
 end

app/controllers/json_controller.rb

@@ -1,21 +1,25 @@
 class JsonController < ApplicationController
   # JSON information on a single package
   def package
+    expires_in 1.hours, public: true
     @p = Package.find_by_name! params[:name]
   end
 
   # JSON information on all packages
   def packages
+    expires_in 1.days, public: true
     @p = Package.all
   end
 
   # JSON information on all screenshots
   def screenshots
+    expires_in 1.days, public: true
     @s = Screenshot.includes(:package)
   end
 
   # JSON list of packages that do not have screenshots
   def packages_without_screenshots
+    expires_in 1.hours, public: true
     @p = Package.without_screenshots.all
   end
 end

app/controllers/packages_controller.rb

@@ -11,18 +11,20 @@ class PackagesController < ApplicationController
   end
 
   def details
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
   end
 
   def upload
-    raise "name not given" unless params[:name]
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
   end
 
   # POST target of the screenshots upload form.
   # Checks upload images and creates a new Screenshot record for it.
   def upload_image
-    @package = Package.find_by(name: params[:name])
+    # Remember the user by the cookie session
+    create_user_token
+
+    @package = Package.find_by!(name: params[:name])
 
     successful_upload_count = 0
 
@@ -61,7 +63,7 @@ class PackagesController < ApplicationController
   # - description
   # - file
   def legacy_uploadfile
-    @package = Package.find_by(name: params[:packagename])
+    @package = Package.find_by!(name: params[:packagename])
 
     new_screenshot = @package.screenshots.new(image: params[:file])
 
@@ -81,7 +83,7 @@ class PackagesController < ApplicationController
 
   def delete_screenshot
     # Is the user allowed to delete the screenshot?
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
 
     if user_can_alter_screenshot?
       @screenshot.destroy
@@ -93,7 +95,7 @@ class PackagesController < ApplicationController
   end
 
   def approve_screenshot
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.approve_screenshot!
     flash['notice'] = "Screenshot approved."
     redirect_to :back
@@ -104,7 +106,7 @@ class PackagesController < ApplicationController
   # If the package is found but has no screenshots then it also returns a
   # dummy image along with status 404.
   def thumbnail
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
     unless @package
       thumbnail404
       return
@@ -133,7 +135,7 @@ class PackagesController < ApplicationController
   # If the package is found but has no screenshots then it also returns a
   # dummy image along with status 404.
   def screenshot
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
     unless @package
       screenshot404
       return
@@ -160,7 +162,7 @@ class PackagesController < ApplicationController
   # Receives a form with a simple text field 'description' so that users can update
   # the description of their screenshot.
   def update_screenshot_description
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.description = params[:description]
     @screenshot.save!
     flash['notice'] = "Description updated."
@@ -169,7 +171,7 @@ class PackagesController < ApplicationController
 
   # Receive an anonymous report from a user to have a screenshot removed.
   def report_screenshot
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.delete_reason = params[:delete_reason]
     @screenshot.markedfordelete = true
     @screenshot.save!
@@ -222,4 +224,12 @@ class PackagesController < ApplicationController
     # - Is the user an admin (=logged in)?
     @screenshot.uploaderhash == session[:token] or user_signed_in?
   end
+
+  # Store a random identifier and the client's IP address in the session
+  # for later identification.
+  def create_user_token
+    session[:token] ||= SecureRandom.hex
+    session[:ip] ||= request.remote_ip
+  end
+
 end