Tweaked the controller to use 'protect_from_forgery' properly

[feedcatcher.git] / app / controllers / feed_controller.rb

diff --git a/app/controllers/feed_controller.rb b/app/controllers/feed_controller.rb
index 2d6fee9786f62166fb4414cef8fa241c67c7f96c..2fd0bd60064b49552ddf3796bff41acc8eb59dcb 100644 (file)
--- a/app/controllers/feed_controller.rb
+++ b/app/controllers/feed_controller.rb
@@ -1,9 +1,9 @@
 class FeedController < ApplicationController
-
-  skip_before_filter :verify_authenticity_token
+  
+  # skip_before_filter :verify_authenticity_token
 
   def index
-    @feeds = FeedItem.find(:all, :select => 'DISTINCT feed_name')
+    @feeds = FeedItem.select(:feed_name).distinct
     respond_to do |format|
       format.html
       format.rss { render :layout => false }
@@ -12,13 +12,13 @@ class FeedController < ApplicationController
 
   
   def show
-    if valid_feed_name?(params[:feed_name])
-      @feed_items = FeedItem.find_all_by_feed_name(params[:feed_name])
+    if FeedItem::valid_feed_name?(params[:feed_name])
       @feed_name = params[:feed_name]
+      @feed_items = FeedItem.in_feed(@feed_name)
       respond_to do |format|
-        if @feed_items == []
-          flash[:notice] = "No items in feed #{params[:feed_name]}"
-          format.html { redirect_to index_url }
+        if @feed_items.empty?
+          flash[:notice] = "No items in feed #{@feed_name}"
+          format.html { redirect_to index_path }
           format.rss  { render :layout => false }
         else
           format.html
@@ -28,7 +28,7 @@ class FeedController < ApplicationController
     else
       respond_to do |format|
         flash[:notice] = "Invalid feed name"
-        format.html { redirect_to index_url }
+        format.html { redirect_to index_path }
         format.rss  { head :not_found}
       end
     end
@@ -36,10 +36,10 @@ class FeedController < ApplicationController
 
 
   def update
-    if valid_feed_name?(params[:new_feed_name])
-      item = FeedItem.find_by_feed_name_and_title(params[:new_feed_name], params[:title])
+    if FeedItem::valid_feed_name?(params[:feed_name])
+      item = FeedItem.in_feed(params[:feed_name]).entitled(params[:title]).take
       if item
-        if params[:description] == ''
+        if params[:description].empty?
           destroy_item(item)
         else
           update_item(item)
@@ -50,72 +50,63 @@ class FeedController < ApplicationController
     else
       respond_to do |format|
         flash[:notice] = "Invalid feed name"
-        format.html { redirect_to index_url }
+        format.html { redirect_to index_path }
         format.rss  { head :not_found }
       end
     end
   end
   
 
-  private
-
-  def valid_feed_name?(feed_name)
-    Rack::Utils::escape(feed_name) == feed_name and
-      Rack::Utils::unescape(feed_name) == feed_name and
-      feed_name != 'index' and
-      feed_name != 'show' and
-      feed_name != 'update' and
-      feed_name != 'action'
-  end
+  # private
 
 
-  def create_item
-    item = FeedItem.new(:feed_name => params[:new_feed_name],
+  private def create_item
+    item = FeedItem.new(:feed_name => params[:feed_name],
       :title => params[:title],
       :description => params[:description])
     item.save!
     flash[:notice] = "Element #{params[:title]} created"
     respond_to do |format|
-      format.html { redirect_to feed_url(params[:new_feed_name]) }
+      format.html { redirect_to feed_path(params[:feed_name]) }
       format.rss  { head :ok }
     end
   rescue ActiveRecord::RecordInvalid => error
     flash[:notice] = "Element #{params[:title]} could not be created"
     respond_to do |format|
-      format.html { redirect_to feed_url(params[:new_feed_name]) }
+      format.html { redirect_to feed_path(params[:feed_name]) }
       format.rss  { head :unprocessable_entity }
     end
   end
 
 
-  def update_item(item)
+  private def update_item(item)
     if item.update_attribute(:description, params[:description])
       flash[:notice] = "Element #{params[:title]} updated"
       respond_to do |format|
-        format.html { redirect_to feed_url(params[:new_feed_name]) }
+        format.html { redirect_to feed_path(params[:feed_name]) }
         format.rss  { head :ok }
       end
     else
       flash[:notice] = "Element #{params[:title]} could not be updated"
       respond_to do |format|
-        format.html { redirect_to feed_url(params[:new_feed_name]) }
+        format.html { redirect_to feed_path(params[:feed_name]) }
         format.rss  { head :unprocessable_entity }
       end
     end
   end
 
 
-  def destroy_item(item)
+  private def destroy_item(item)
     if item.destroy
-      flash[:notice] = "Element #{params[:title]} destroyed"
+      flash[:notice] = "Element #{params[:title]} deleted"
       respond_to do |format|
-        format.html { redirect_to feed_url(params[:new_feed_name]) }
+        format.html { redirect_to feed_path(params[:feed_name]) }
         format.rss  { head :ok }
       end
     else
-      flash[:notice] = "Element #{params[:title]} could not be destroyed"
+      flash[:notice] = "Element #{params[:title]} could not be deleted"
       respond_to do |format|
-        format.html { redirect_to feed_url(params[:new_feed_name]) }
+        format.html { redirect_to feed_path(params[:feed_name]) }
         format.rss  { head :unprocessable_entity }
       end
     end