Merge branch 'master' of git.workaround.org:chaas/debshots

app/assets/stylesheets/_settings.scss

@@ -584,7 +584,24 @@ $topbar-breakpoint: 800px;
 $topbar-media-query: "only screen and (min-width: #{$topbar-breakpoint})";
 
 // Import Google font
-@import url(http://fonts.googleapis.com/css?family=Droid+Sans:400,700);
+// @import url(//fonts.googleapis.com/css?family=Droid+Sans:400,700);
+
+// Use fonts from out own site. Do not load from Google for privacy reasons.
+@font-face {
+  font-family: 'Droid Sans';
+  font-style: normal;
+  font-weight: 400;
+  src: local('Droid Sans'), local('DroidSans'), url(/fonts/DroidSans.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2212, U+2215, U+E0FF, U+EFFD, U+F000;
+}
+@font-face {
+  font-family: 'Droid Sans';
+  font-style: normal;
+  font-weight: 700;
+  src: local('Droid Sans Bold'), local('DroidSans-Bold'), url(/fonts/DroidSans-Bold.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2212, U+2215, U+E0FF, U+EFFD, U+F000;
+}
+
 $body-font-family: "Droid Sans";
 
 $button-tny: rem-calc(4);

app/controllers/application_controller.rb

@@ -3,15 +3,6 @@ class ApplicationController < ActionController::Base
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 
-  before_filter :create_user_token
-
   # Do not mention passwords in the log file
   # filter_parameter_logging :password
-
-  # Assign the visitor a unique hash so that we can track their uploads
-  # and show them even before moderation.
-  def create_user_token
-    session[:token] ||= SecureRandom.hex
-    session[:ip] ||= request.remote_ip
-  end
 end

app/controllers/json_controller.rb

@@ -1,21 +1,25 @@
 class JsonController < ApplicationController
   # JSON information on a single package
   def package
+    expires_in 1.hours, public: true
     @p = Package.find_by_name! params[:name]
   end
 
   # JSON information on all packages
   def packages
+    expires_in 1.days, public: true
     @p = Package.all
   end
 
   # JSON information on all screenshots
   def screenshots
+    expires_in 1.days, public: true
     @s = Screenshot.includes(:package)
   end
 
   # JSON list of packages that do not have screenshots
   def packages_without_screenshots
+    expires_in 1.hours, public: true
     @p = Package.without_screenshots.all
   end
 end

app/controllers/packages_controller.rb

@@ -11,18 +11,20 @@ class PackagesController < ApplicationController
   end
 
   def details
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
   end
 
   def upload
-    raise "name not given" unless params[:name]
+    @package = Package.find_by!(name: params[:name])
-    @package = Package.find_by(name: params[:name])
   end
 
   # POST target of the screenshots upload form.
   # Checks upload images and creates a new Screenshot record for it.
   def upload_image
-    @package = Package.find_by(name: params[:name])
+    # Remember the user by the cookie session
+    create_user_token
+
+    @package = Package.find_by!(name: params[:name])
 
     successful_upload_count = 0
 
@@ -61,7 +63,7 @@ class PackagesController < ApplicationController
   # - description
   # - file
   def legacy_uploadfile
-    @package = Package.find_by(name: params[:packagename])
+    @package = Package.find_by!(name: params[:packagename])
 
     new_screenshot = @package.screenshots.new(image: params[:file])
 
@@ -81,7 +83,7 @@ class PackagesController < ApplicationController
 
   def delete_screenshot
     # Is the user allowed to delete the screenshot?
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
 
     if user_can_alter_screenshot?
       @screenshot.destroy
@@ -93,7 +95,7 @@ class PackagesController < ApplicationController
   end
 
   def approve_screenshot
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.approve_screenshot!
     flash['notice'] = "Screenshot approved."
     redirect_to :back
@@ -104,7 +106,7 @@ class PackagesController < ApplicationController
   # If the package is found but has no screenshots then it also returns a
   # dummy image along with status 404.
   def thumbnail
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
     unless @package
       thumbnail404
       return
@@ -133,7 +135,7 @@ class PackagesController < ApplicationController
   # If the package is found but has no screenshots then it also returns a
   # dummy image along with status 404.
   def screenshot
-    @package = Package.find_by(name: params[:name])
+    @package = Package.find_by!(name: params[:name])
     unless @package
       screenshot404
       return
@@ -160,7 +162,7 @@ class PackagesController < ApplicationController
   # Receives a form with a simple text field 'description' so that users can update
   # the description of their screenshot.
   def update_screenshot_description
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.description = params[:description]
     @screenshot.save!
     flash['notice'] = "Description updated."
@@ -169,7 +171,7 @@ class PackagesController < ApplicationController
 
   # Receive an anonymous report from a user to have a screenshot removed.
   def report_screenshot
-    @screenshot = Screenshot.find(params[:id])
+    @screenshot = Screenshot.find!(params[:id])
     @screenshot.delete_reason = params[:delete_reason]
     @screenshot.markedfordelete = true
     @screenshot.save!
@@ -222,4 +224,12 @@ class PackagesController < ApplicationController
     # - Is the user an admin (=logged in)?
     @screenshot.uploaderhash == session[:token] or user_signed_in?
   end
+
+  # Store a random identifier and the client's IP address in the session
+  # for later identification.
+  def create_user_token
+    session[:token] ||= SecureRandom.hex
+    session[:ip] ||= request.remote_ip
+  end
+
 end

app/models/screenshot.rb

@@ -92,9 +92,9 @@ class Screenshot < ActiveRecord::Base
   end
 
   # Return the number of screenshots that need to be approved
-  def self.unapproved
+  # def self.unapproved
-    self.where(approved: false)
+  #   self.where(approved: false)
-  end
+  # end
 
   # Publish a screenshot from the moderation queue
   def approve_screenshot!

public/robots.txt

@@ -1,4 +1,3 @@
 User-agent: *
 Disallow: /json
-Disallow: /api
+Disallow: /upload
-Disallow: