Victor Costa · Leandro Santos · Leandro Santos · Leandro Santos · Victor Costa · Leandro Santos
Showing 341 changed files Show diff stats
app/api/app.rb
app/api/entities.rb
app/api/helpers.rb
app/api/v1/people.rb
app/api/v1/roles.rb
app/api/v1/tasks.rb
app/concerns/authenticated_system.rb
app/controllers/admin/categories_controller.rb
app/controllers/application_controller.rb
app/controllers/box_organizer_controller.rb
app/controllers/concerns/authenticated_system.rb
app/controllers/concerns/custom_design.rb
app/controllers/concerns/needs_profile.rb
app/controllers/my_profile/circles_controller.rb
app/controllers/my_profile/followers_controller.rb
app/controllers/my_profile/tasks_controller.rb
app/controllers/public/account_controller.rb
app/controllers/public/content_viewer_controller.rb
app/controllers/public/profile_controller.rb
app/helpers/action_tracker_helper.rb
@@ -54,6 +54,7 @@ module Api
     mount V1::Blocks
     mount V1::Profiles
     mount V1::Activities
+    mount V1::Roles
  
     # hook point which allow plugins to add Grape::API extensions to Api::App
     #finds for plugins which has api mount points classes defined (the class should extends Grape::API)
@@ -111,6 +111,10 @@ module Api
           hash[value.custom_field.name]=value.value
         end
  
+        profile.public_fields.each do |field|
+          hash[field] = profile.send(field.to_sym)
+        end
+
         private_values = profile.custom_field_values - profile.public_values
         private_values.each do |value|
           if Entities.can_display_profile_field?(profile,options)
@@ -124,6 +128,7 @@ module Api
       expose :type
       expose :custom_header
       expose :custom_footer
+      expose :layout_template
       expose :permissions do |profile, options|
         Entities.permissions_for_entity(profile, options[:current_person],
         :allow_post_content?, :allow_edit?, :allow_destroy?)
@@ -258,12 +263,28 @@ module Api
       root 'tasks', 'task'
       expose :id
       expose :type
+      expose :requestor, using: Profile
+      expose :status
+      expose :created_at
+      expose :data
+      expose :accept_details
+      expose :reject_details
+      expose :accept_disabled?, as: :accept_disabled
+      expose :reject_disabled?, as: :reject_disabled
+      expose :target do |task, options|
+        type_map = {Profile => ::Profile, Environment => ::Environment}.find {|h| task.target.kind_of?(h.last)}
+        type_map.first.represent(task.target) unless type_map.nil?
+      end
     end
  
     class Environment < Entity
       expose :name
       expose :id
       expose :description
+      expose :layout_template
+      expose :signup_intro
+      expose :terms_of_use
+      expose :top_url, as: :host
       expose :settings, if: lambda { |instance, options| options[:is_admin] }
     end
  
@@ -281,5 +302,12 @@ module Api
         type_map.first.represent(activity.target) unless type_map.nil?
       end
     end
+
+    class Role < Entity
+      root 'roles', 'role'
+      expose :id
+      expose :name
+      expose :key
+    end
   end
 end
@@ -4,7 +4,7 @@ require &#39;tempfile&#39;
 module Api
   module Helpers
     PRIVATE_TOKEN_PARAM = :private_token
-    DEFAULT_ALLOWED_PARAMETERS = [:parent_id, :from, :until, :content_type, :author_id, :identifier, :archived]
+    ALLOWED_PARAMETERS = [:parent_id, :from, :until, :content_type, :author_id, :identifier, :archived, :status]
  
     include SanitizeParams
     include Noosfero::Plugin::HotSpot
@@ -124,8 +124,8 @@ module Api
       present_partial article, with: Entities::Article, params: params, current_person: current_person
     end
  
-    def present_articles_for_asset(asset, method = 'articles')
-      articles = find_articles(asset, method)
+    def present_articles_for_asset(asset, method_or_relation = 'articles')
+      articles = find_articles(asset, method_or_relation)
       present_articles(articles)
     end
  
@@ -133,8 +133,8 @@ module Api
       present_partial paginate(articles), :with => Entities::Article, :params => params, current_person: current_person
     end
  
-    def find_articles(asset, method = 'articles')
-      articles = select_filtered_collection_of(asset, method, params)
+    def find_articles(asset, method_or_relation = 'articles')
+      articles = select_filtered_collection_of(asset, method_or_relation, params)
       if current_person.present?
         articles = articles.display_filter(current_person, nil)
       else
@@ -143,14 +143,17 @@ module Api
       articles
     end
  
-    def find_task(asset, id)
-      task = asset.tasks.find(id)
+    def find_task(asset, method_or_relation, id)
+      task = is_a_relation?(method_or_relation) ? method_or_relation : asset.send(method_or_relation)
+      task = task.find_by_id(id)
+      not_found! if task.blank?
       current_person.has_permission?(task.permission, asset) ? task : forbidden!
     end
  
     def post_task(asset, params)
       klass_type= params[:content_type].nil? ? 'Task' : params[:content_type]
       return forbidden! unless klass_type.constantize <= Task
+      return forbidden! if !current_person.has_permission?(:perform_task, asset)
  
       task = klass_type.constantize.new(params[:task])
       task.requestor_id = current_person.id
@@ -163,15 +166,24 @@ module Api
       present_partial task, :with => Entities::Task
     end
  
-    def present_task(asset)
-      task = find_task(asset, params[:id])
+    def find_tasks(asset, method_or_relation = 'tasks')
+      return forbidden! if !current_person.has_permission?(:perform_task, asset)
+      tasks = select_filtered_collection_of(asset, method_or_relation, params)
+      tasks = tasks.select {|t| current_person.has_permission?(t.permission, asset)}
+      tasks
+    end
+
+    def present_task(asset, method_or_relation = 'tasks')
+      task = find_task(asset, method_or_relation, params[:id])
       present_partial task, :with => Entities::Task
     end
  
-    def present_tasks(asset)
-      tasks = select_filtered_collection_of(asset, 'tasks', params)
-      tasks = tasks.select {|t| current_person.has_permission?(t.permission, asset)}
-      return forbidden! if tasks.empty? && !current_person.has_permission?(:perform_task, asset)
+    def present_tasks_for_asset(asset, method_or_relation = 'tasks')
+      tasks = find_tasks(asset, method_or_relation)
+      present_tasks(tasks)
+    end
+
+    def present_tasks(tasks)
       present_partial tasks, :with => Entities::Task
     end
  
@@ -180,7 +192,6 @@ module Api
       conditions = {}
       from_date = DateTime.parse(parsed_params.delete(:from)) if parsed_params[:from]
       until_date = DateTime.parse(parsed_params.delete(:until)) if parsed_params[:until]
-
       conditions[:type] = parse_content_type(parsed_params.delete(:content_type)) unless parsed_params[:content_type].nil?
  
       conditions[:created_at] = period(from_date, until_date) if from_date || until_date
@@ -190,7 +201,7 @@ module Api
     end
  
     # changing make_order_with_parameters to avoid sql injection
-    def make_order_with_parameters(object, method, params)
+    def make_order_with_parameters(object, method_or_relation, params)
       order = "created_at DESC"
       unless params[:order].blank?
         if params[:order].include? '\'' or params[:order].include? '"'
@@ -199,9 +210,9 @@ module Api
           order = 'RANDOM()'
         else
           field_name, direction = params[:order].split(' ')
-          assoc = object.class.reflect_on_association(method.to_sym)
-          if !field_name.blank? and assoc
-            if assoc.klass.attribute_names.include? field_name
+          assoc_class = extract_associated_classname(method_or_relation)
+          if !field_name.blank? and assoc_class
+            if assoc_class.attribute_names.include? field_name
               if direction.present? and ['ASC','DESC'].include? direction.upcase
                 order = "#{field_name} #{direction.upcase}"
               end
@@ -212,12 +223,14 @@ module Api
       return order
     end
  
-    def make_timestamp_with_parameters_and_method(params, method)
+    def make_timestamp_with_parameters_and_method(params, method_or_relation)
       timestamp = nil
       if params[:timestamp]
         datetime = DateTime.parse(params[:timestamp])
-        table_name = method.to_s.singularize.camelize.constantize.table_name
-        timestamp = "#{table_name}.updated_at >= '#{datetime}'"
+        table_name = extract_associated_tablename(method_or_relation)
+        assoc_class = extract_associated_classname(method_or_relation)
+        date_atrr = assoc_class.attribute_names.include?('updated_at') ? 'updated_at' : 'created_at'
+        timestamp = "#{table_name}.#{date_atrr} >= '#{datetime}'"
       end
  
       timestamp
@@ -242,12 +255,12 @@ module Api
       end
     end
  
-    def select_filtered_collection_of(object, method, params)
+    def select_filtered_collection_of(object, method_or_relation, params)
       conditions = make_conditions_with_parameter(params)
-      order = make_order_with_parameters(object,method,params)
-      timestamp = make_timestamp_with_parameters_and_method(params, method)
+      order = make_order_with_parameters(object,method_or_relation,params)
+      timestamp = make_timestamp_with_parameters_and_method(params, method_or_relation)
  
-      objects = object.send(method)
+      objects = is_a_relation?(method_or_relation) ? method_or_relation : object.send(method_or_relation)
       objects = by_reference(objects, params)
       objects = by_categories(objects, params)
  
@@ -302,12 +315,12 @@ module Api
     end
  
     def cant_be_saved_request!(attribute)
-      message = _("(Invalid request) %s can't be saved") % attribute
+      message = _("(Invalid request) %s can't be saved").html_safe % attribute
       render_api_error!(message, 400)
     end
  
     def bad_request!(attribute)
-      message = _("(Invalid request) %s not given") % attribute
+      message = _("(Invalid request) %s not given").html_safe % attribute
       render_api_error!(message, 400)
     end
  
@@ -393,10 +406,27 @@ module Api
     end
     private
  
+    def extract_associated_tablename(method_or_relation)
+      extract_associated_classname(method_or_relation).table_name
+    end
+
+    def extract_associated_classname(method_or_relation)
+      if is_a_relation?(method_or_relation)
+        method_or_relation.blank? ? '' : method_or_relation.first.class
+      else
+        method_or_relation.to_s.singularize.camelize.constantize
+      end
+    end
+
+    def is_a_relation?(method_or_relation)
+      method_or_relation.kind_of?(ActiveRecord::Relation)
+    end
+  
+
     def parser_params(params)
       parsed_params = {}
       params.map do |k,v|
-        parsed_params[k.to_sym] = v if DEFAULT_ALLOWED_PARAMETERS.include?(k.to_sym)
+        parsed_params[k.to_sym] = v if ALLOWED_PARAMETERS.include?(k.to_sym)
       end
       parsed_params
     end
@@ -119,6 +119,20 @@ module Api
               members = select_filtered_collection_of(profile, 'members', params)
               present members, :with => Entities::Person, :current_person => current_person
             end
+
+            post do
+              authenticate!
+              profile = environment.profiles.find_by id: params[:profile_id]
+              profile.add_member(current_person) rescue forbidden!
+              {pending: !current_person.is_member_of?(profile)}
+            end
+
+            delete do
+              authenticate!
+              profile = environment.profiles.find_by id: params[:profile_id]
+              profile.remove_member(current_person)
+              present current_person, :with => Entities::Person, :current_person => current_person
+            end
           end
         end
       end
@@ -0,0 +1,25 @@
+module Api
+  module V1
+    class Roles < Grape::API
+      before { authenticate! }
+
+      MAX_PER_PAGE = 50
+
+      resource :profiles do
+        segment "/:profile_id" do
+          resource :roles do
+
+            paginate max_per_page: MAX_PER_PAGE
+            get do
+              profile = environment.profiles.find(params[:profile_id])
+              return forbidden! unless profile.kind_of?(Organization)
+              roles = Profile::Roles.organization_roles(profile.environment.id, profile.id)
+              present_partial paginate(roles), with: Entities::Role
+            end
+            
+          end
+        end
+      end
+    end
+  end
+end
 module Api
   module V1
     class Tasks < Grape::API
-#      before { authenticate! }
+      before { authenticate! }
  
-#      ARTICLE_TYPES = Article.descendants.map{|a| a.to_s}
+      MAX_PER_PAGE = 50
  
       resource :tasks do
  
-        # Collect tasks
+        paginate max_per_page: MAX_PER_PAGE
+        # Collect all tasks that current person has permission
         #
         # Parameters:
         #   from             - date where the search will begin. If nothing is passed the default date will be the date of the first article created
@@ -17,15 +18,27 @@ module Api
         # Example Request:
         #  GET host/api/v1/tasks?from=2013-04-04-14:41:43&until=2015-04-04-14:41:43&limit=10&private_token=e96fff37c2238fdab074d1dcea8e6317
         get do
-          tasks = select_filtered_collection_of(environment, 'tasks', params)
-          tasks = tasks.select {|t| current_person.has_permission?(t.permission, environment)}
-          present_partial tasks, :with => Entities::Task
+          tasks = Task.to(current_person)
+          present_tasks_for_asset(current_person, tasks)
         end
  
         desc "Return the task id"
         get ':id' do
-          task = find_task(environment, params[:id])
-          present_partial task, :with => Entities::Task
+          present_task(current_person, Task.to(current_person))
+        end
+
+        %w[finish cancel].each do |action|
+          desc "#{action.capitalize} a task"
+          put ":id/#{action}" do
+            task = find_task(current_person, Task.to(current_person), params[:id])
+            begin
+              task.update(params[:task])
+              task.send(action, current_person) if (task.status == Task::Status::ACTIVE)
+              present_partial task, :with => Entities::Task
+            rescue Exception => ex
+              render_api_error!(ex.message, 500)
+            end
+          end
         end
       end
  
@@ -36,7 +49,8 @@ module Api
             resource :tasks do
               get do
                 profile = environment.send(kind.pluralize).find(params["#{kind}_id"])
-                present_tasks(profile)
+                tasks = Task.to(profile)
+                present_tasks_for_asset(profile, tasks)
               end
  
               get ':id' do
@@ -44,7 +44,7 @@ class CategoriesController &lt; AdminController
       if request.post?
         @category.update!(params[:category])
         @saved = true
-        session[:notice] = _("Category %s saved." % @category.name)
+        session[:notice] = _("Category %s saved." % @category.name).html_safe
         redirect_to :action => 'index'
       end
     rescue Exception => e
@@ -14,6 +14,20 @@ class ApplicationController &lt; ActionController::Base
   before_filter :redirect_to_current_user
  
   before_filter :set_session_theme
+
+  # FIXME: only include necessary methods
+  include ApplicationHelper
+
+  # concerns
+  include PermissionCheck
+  include CustomDesign
+  include NeedsProfile
+
+  # implementations
+  include FindByContents
+  include Noosfero::Plugin::HotSpot
+  include SearchTermHelper
+
   def set_session_theme
     if params[:theme]
       session[:theme] = environment.theme_ids.include?(params[:theme]) ? params[:theme] : nil
@@ -48,7 +62,6 @@ class ApplicationController &lt; ActionController::Base
     end
   end
  
-  include ApplicationHelper
   layout :get_layout
   def get_layout
     return false if request.format == :js or request.xhr?
@@ -74,9 +87,6 @@ class ApplicationController &lt; ActionController::Base
   helper :document
   helper :language
  
-  include DesignHelper
-  include PermissionCheck
-
   before_filter :set_locale
   def set_locale
     FastGettext.available_locales = environment.available_locales
@@ -89,8 +99,6 @@ class ApplicationController &lt; ActionController::Base
     end
   end
  
-  include NeedsProfile
-
   attr_reader :environment
  
   # declares that the given <tt>actions</tt> cannot be accessed by other HTTP
@@ -107,6 +115,10 @@ class ApplicationController &lt; ActionController::Base
  
   protected
  
+  def accept_only_post
+    return render_not_found if !request.post?
+  end
+
   def verified_request?
     super || form_authenticity_token == request.headers['X-XSRF-TOKEN']
   end
@@ -151,8 +163,6 @@ class ApplicationController &lt; ActionController::Base
     end
   end
  
-  include Noosfero::Plugin::HotSpot
-
   # FIXME this filter just loads @plugins to children controllers and helpers
   def init_noosfero_plugins
     plugins
@@ -184,9 +194,6 @@ class ApplicationController &lt; ActionController::Base
     end
   end
  
-  include SearchTermHelper
-  include FindByContents
-
   def find_suggestions(query, context, asset, options={})
     plugins.dispatch_first(:find_suggestions, query, context, asset, options)
   end
@@ -109,7 +109,7 @@ class BoxOrganizerController &lt; ApplicationController
   def show_block_type_info
     type = params[:type]
     if type.blank? || !available_blocks.map(&:name).include?(type)
-      raise ArgumentError.new("Type %s is not allowed. Go away." % type)
+      raise ArgumentError.new("Type %s is not allowed. Go away.".html_safe % type)
     end
     @block = type.constantize.new
     @block.box = Box.new(:owner => boxes_holder)
@@ -122,7 +122,7 @@ class BoxOrganizerController &lt; ApplicationController
  
   def new_block(type, box)
     if !available_blocks.map(&:name).include?(type)
-      raise ArgumentError.new("Type %s is not allowed. Go away." % type)
+      raise ArgumentError.new("Type %s is not allowed. Go away.".html_safe % type)
     end
     block = type.constantize.new
     box.blocks << block
@@ -0,0 +1,169 @@
+module AuthenticatedSystem
+
+  protected
+
+    extend ActiveSupport::Concern
+
+    included do
+      if self < ActionController::Base
+        around_filter :user_set_current
+        before_filter :override_user
+        before_filter :login_from_cookie
+      end
+
+      # Inclusion hook to make #current_user and #logged_in?
+      # available as ActionView helper methods.
+      helper_method :current_user, :logged_in?
+    end
+
+    # Returns true or false if the user is logged in.
+    # Preloads @current_user with the user model if they're logged in.
+    def logged_in?
+      current_user != nil
+    end
+
+    # Accesses the current user from the session.
+    def current_user user_id = session[:user]
+      @current_user ||= begin
+        user = User.find_by id: user_id if user_id
+        user.session = session if user
+        User.current = user
+        user
+      end
+    end
+
+    # Store the given user in the session.
+    def current_user=(new_user)
+      if new_user.nil?
+        session.delete(:user)
+      else
+        session[:user] = new_user.id
+        new_user.session = session
+        new_user.register_login
+      end
+      @current_user = User.current = new_user
+    end
+
+    # See impl. from http://stackoverflow.com/a/2513456/670229
+    def user_set_current
+      User.current = current_user
+      yield
+    ensure
+      # to address the thread variable leak issues in Puma/Thin webserver
+      User.current = nil
+    end
+
+    # Check if the user is authorized.
+    #
+    # Override this method in your controllers if you want to restrict access
+    # to only a few actions or if you want to check if the user
+    # has the correct rights.
+    #
+    # Example:
+    #
+    #  # only allow nonbobs
+    #  def authorize?
+    #    current_user.login != "bob"
+    #  end
+    def authorized?
+      true
+    end
+
+    # Filter method to enforce a login requirement.
+    #
+    # To require logins for all actions, use this in your controllers:
+    #
+    #   before_filter :login_required
+    #
+    # To require logins for specific actions, use this in your controllers:
+    #
+    #   before_filter :login_required, :only => [ :edit, :update ]
+    #
+    # To skip this in a subclassed controller:
+    #
+    #   skip_before_filter :login_required
+    #
+    def login_required
+      username, passwd = get_auth_data
+      if username && passwd
+        self.current_user ||= User.authenticate(username, passwd) || nil
+      end
+      if logged_in? && authorized?
+        true
+      else
+        if params[:require_login_popup]
+          render :json => { :require_login_popup => true }
+        else
+          access_denied
+        end
+      end
+    end
+
+    # Redirect as appropriate when an access request fails.
+    #
+    # The default action is to redirect to the login screen.
+    #
+    # Override this method in your controllers if you want to have special
+    # behavior in case the user is not authorized
+    # to access the requested action.  For example, a popup window might
+    # simply close itself.
+    def access_denied
+      respond_to do |accepts|
+        accepts.html do
+          if request.xhr?
+            render :text => _('Access denied'), :status => 401
+          else
+            store_location
+            redirect_to :controller => '/account', :action => 'login'
+          end
+        end
+        accepts.xml do
+          headers["Status"]           = "Unauthorized"
+          headers["WWW-Authenticate"] = %(Basic realm="Web Password")
+          render :text => "Could't authenticate you", :status => '401 Unauthorized'
+        end
+      end
+      false
+    end
+
+    # Store the URI of the current request in the session.
+    #
+    # We can return to this location by calling #redirect_back_or_default.
+    def store_location(location = request.url)
+      session[:return_to] = location
+    end
+
+    # Redirect to the URI stored by the most recent store_location call or
+    # to the passed default.
+    def redirect_back_or_default(default)
+      if session[:return_to]
+        redirect_to(session.delete(:return_to))
+      else
+        redirect_to(default)
+      end
+    end
+
+    def override_user
+      return if params[:override_user].blank?
+      return unless logged_in? and user.is_admin? environment
+      @current_user = nil
+      current_user params[:override_user]
+    end
+
+    # When called with before_filter :login_from_cookie will check for an :auth_token
+    # cookie and log the user back in if apropriate
+    def login_from_cookie
+      return if cookies[:auth_token].blank? or logged_in?
+      user = User.where(remember_token: cookies[:auth_token]).first
+      self.current_user = user if user and user.remember_token?
+    end
+
+  private
+    @@http_auth_headers = %w(X-HTTP_AUTHORIZATION HTTP_AUTHORIZATION Authorization)
+    # gets BASIC auth info
+    def get_auth_data
+      auth_key  = @@http_auth_headers.detect { |h| request.env.has_key?(h) }
+      auth_data = request.env[auth_key].to_s.split unless auth_key.blank?
+      return auth_data && auth_data[0] == 'Basic' ? Base64.decode64(auth_data[1]).split(':')[0..1] : [nil, nil]
+    end
+end
@@ -0,0 +1,50 @@
+module CustomDesign
+
+  extend ActiveSupport::Concern
+
+  included do
+    extend ClassMethods
+    include InstanceMethods
+    before_filter :load_custom_design if self.respond_to? :before_filter
+  end
+
+  module ClassMethods
+
+    def no_design_blocks
+      @no_design_blocks = true
+    end
+
+    def use_custom_design options = {}
+      @custom_design = options
+    end
+
+    def custom_design
+      @custom_design ||= {}
+    end
+
+    def uses_design_blocks?
+      !@no_design_blocks
+    end
+
+  end
+
+  module InstanceMethods
+
+    protected
+
+    def uses_design_blocks?
+      !@no_design_blocks && self.class.uses_design_blocks?
+    end
+
+    def load_custom_design
+      # see also: LayoutHelper#body_classes
+      @layout_template = self.class.custom_design[:layout_template]
+    end
+
+    def custom_design
+      @custom_design || self.class.custom_design
+    end
+
+  end
+
+end
@@ -0,0 +1,40 @@
+module NeedsProfile
+
+  module ClassMethods
+    def needs_profile
+      before_filter :load_profile
+    end
+  end
+
+  def self.included(including)
+    including.send(:extend, NeedsProfile::ClassMethods)
+  end
+
+  def boxes_holder
+    profile || environment # prefers profile, but defaults to environment
+  end
+
+  def profile
+    @profile
+  end
+
+  protected
+
+  def load_profile
+    if params[:profile]
+      params[:profile].downcase!
+      @profile ||= environment.profiles.where(identifier: params[:profile]).first
+    end
+
+    if @profile
+      profile_hostname = @profile.hostname
+      if profile_hostname && profile_hostname != request.host
+        params.delete(:profile)
+        redirect_to(Noosfero.url_options.merge(params).merge(:host => profile_hostname))
+      end
+    else
+      render_not_found
+    end
+  end
+
+end
@@ -0,0 +1,58 @@
+class CirclesController < MyProfileController
+
+  before_action :accept_only_post, :only => [:create, :update, :destroy]
+
+  def index
+    @circles = profile.circles
+  end
+
+  def new
+    @circle = Circle.new
+  end
+
+  def create
+    @circle = Circle.new(params[:circle].merge({ :person => profile }))
+    if @circle.save
+      redirect_to :action => 'index'
+    else
+      render :action => 'new'
+    end
+  end
+
+  def xhr_create
+    if request.xhr?
+      circle = Circle.new(params[:circle].merge({:person => profile }))
+      if circle.save
+        render :partial => "circle_checkbox", :locals => { :circle => circle },
+               :status => 201
+      else
+        render :text => _('The circle could not be saved'), :status => 400
+      end
+    else
+      render_not_found
+    end
+  end
+
+  def edit
+    @circle = Circle.find_by_id(params[:id])
+    render_not_found if @circle.nil?
+  end
+
+  def update
+    @circle = Circle.find_by_id(params[:id])
+    return render_not_found if @circle.nil?
+
+    if @circle.update(params[:circle])
+      redirect_to :action => 'index'
+    else
+      render :action => 'edit'
+    end
+  end
+
+  def destroy
+    @circle = Circle.find_by_id(params[:id])
+    return render_not_found if @circle.nil?
+    @circle.destroy
+    redirect_to :action => 'index'
+  end
+end
@@ -0,0 +1,43 @@
+class FollowersController < MyProfileController
+
+  before_action :only_for_person, :only => :index
+  before_action :accept_only_post, :only => [:update_category]
+
+  def index
+    @followed_people = profile.followed_profiles.order(:type)
+    @profile_types = {_('All profiles') => nil}.merge(Circle.profile_types).to_a
+
+    if params['filter'].present?
+      @followed_people = @followed_people.where(:type => params['filter'])
+      @active_filter = params['filter']
+    end
+
+    @followed_people = @followed_people.paginate(:per_page => 15, :page => params[:npage])
+  end
+
+  def set_category_modal
+    followed_profile = Profile.find(params[:followed_profile_id])
+    circles = Circle.where(:person => profile, :profile_type => followed_profile.class.name)
+    render :partial => 'followers/edit_circles_modal', :locals => { :circles => circles, :followed_profile => followed_profile }
+  end
+
+  def update_category
+    followed_profile = Profile.find_by(:id => params["followed_profile_id"])
+
+    selected_circles = params[:circles].map{ |circle_name, circle_id| Circle.find_by(:id => circle_id) }.select{ |c| c.present? }
+
+    if followed_profile
+      profile.update_profile_circles(followed_profile, selected_circles)
+      render :text => _("Circles of %s updated successfully") % followed_profile.name, :status => 200
+    else
+      render :text => _("Error: No profile to follow."), :status => 400
+    end
+  end
+
+  protected
+
+  def only_for_person
+    render_not_found unless profile.person?
+  end
+
+end
@@ -14,7 +14,7 @@ class TasksController &lt; MyProfileController
     @filter_text = params[:filter_text].presence
     @filter_responsible = params[:filter_responsible]
     @task_types = Task.pending_types_for(profile)
-    @tasks = Task.pending_all(profile, @filter_type, @filter_text).order_by('created_at', 'asc').paginate(:per_page => Task.per_page, :page => params[:page])
+    @tasks = Task.pending_all_by_filter(profile, @filter_type, @filter_text).order_by('created_at', 'asc').paginate(:per_page => Task.per_page, :page => params[:page])
     @tasks = @tasks.where(:responsible_id => @filter_responsible.to_i != -1 ? @filter_responsible : nil) if @filter_responsible.present?
     @tasks = @tasks.paginate(:per_page => Task.per_page, :page => params[:page])
     @failed = params ? params[:failed] : {}
@@ -101,7 +101,7 @@ class TasksController &lt; MyProfileController
   def search_tasks
     filter_type = params[:filter_type].presence
     filter_text = params[:filter_text].presence
-    result = Task.pending_all(profile,filter_type, filter_text)
+    result = Task.pending_all_by_filter(profile,filter_type, filter_text)
  
     render :json => result.map { |task| {:label => task.data[:name], :value => task.data[:name]} }
   end
@@ -205,7 +205,7 @@ class AccountController &lt; ApplicationController
         if params[:value].blank?
           @change_password.errors[:base] << _('Can not recover user password with blank value.')
         else
-          @change_password.errors[:base] << _('Could not find any user with %s equal to "%s".') % [fields_label, params[:value]]
+          @change_password.errors[:base] << _('Could not find any user with %s equal to "%s".').html_safe % [fields_label, params[:value]]
         end
       rescue ActiveRecord::RecordInvalid
         @change_password.errors[:base] << _('Could not perform password recovery for the user.')
@@ -128,9 +128,9 @@ class ContentViewerController &lt; ApplicationController
     end
  
     unless @page.display_to?(user)
-      if !profile.visible? || profile.secret? || (user && user.follows?(profile)) || user.blank?
+      if !profile.visible? || profile.secret? || (user && profile.in_social_circle?(user)) || user.blank?
         render_access_denied
-      else #!profile.public?
+      else
         private_profile_partial_parameters
         render :template => 'profile/_private_profile', :status => 403, :formats => [:html]
       end
@@ -3,7 +3,9 @@ class ProfileController &lt; PublicController
   needs_profile
   before_filter :check_access_to_profile, :except => [:join, :join_not_logged, :index, :add]
   before_filter :store_location, :only => [:join, :join_not_logged, :report_abuse, :send_mail]
-  before_filter :login_required, :only => [:add, :join, :leave, :unblock, :leave_scrap, :remove_scrap, :remove_activity, :view_more_activities, :view_more_network_activities, :report_abuse, :register_report, :leave_comment_on_activity, :send_mail]
+  before_filter :login_required, :only => [:add, :join, :leave, :unblock, :leave_scrap, :remove_scrap, :remove_activity, :view_more_activities, :view_more_network_activities, :report_abuse, :register_report, :leave_comment_on_activity, :send_mail, :follow, :unfollow]
+  before_filter :allow_followers?, :only => [:follow, :unfollow]
+  before_filter :accept_only_post, :only => [:follow, :unfollow]
  
   helper TagsHelper
   helper ActionTrackerHelper
@@ -42,8 +44,8 @@ class ProfileController &lt; PublicController
     feed_writer = FeedWriter.new
     data = feed_writer.write(
       tagged,
-      :title => _("%s's contents tagged with \"%s\"") % [profile.name, @tag],
-      :description => _("%s's contents tagged with \"%s\"") % [profile.name, @tag],
+      :title => _("%s's contents tagged with \"%s\"").html_safe % [profile.name, @tag],
+      :description => _("%s's contents tagged with \"%s\"").html_safe % [profile.name, @tag],
       :link => url_for(profile.url)
     )
     render :text => data, :content_type => "text/xml"
@@ -65,6 +67,14 @@ class ProfileController &lt; PublicController
     end
   end
  
+  def following
+    @followed_people = profile.followed_profiles.paginate(:per_page => per_page, :page => params[:npage], :total_entries => profile.followed_profiles.count)
+  end
+
+  def followed
+    @followed_by = profile.followers.paginate(:per_page => per_page, :page => params[:npage], :total_entries => profile.followers.count)
+  end
+
   def members
     if is_cache_expired?(profile.members_cache_key(params))
       sort = (params[:sort] == 'desc') ? params[:sort] : 'asc'
@@ -88,7 +98,7 @@ class ProfileController &lt; PublicController
  
   def join_modal
       profile.add_member(user)
-      session[:notice] = _('%s administrator still needs to accept you as member.') % profile.name
+      session[:notice] = _('%s administrator still needs to accept you as member.').html_safe % profile.name
       redirect_to :action => :index
   end
  
@@ -98,12 +108,12 @@ class ProfileController &lt; PublicController
  
       profile.add_member(user)
       if !profile.members.include?(user)
-        render :text => {:message => _('%s administrator still needs to accept you as member.') % profile.name}.to_json
+        render :text => {:message => _('%s administrator still needs to accept you as member.').html_safe % profile.name}.to_json
       else
-        render :text => {:message => _('You just became a member of %s.') % profile.name}.to_json
+        render :text => {:message => _('You just became a member of %s.').html_safe % profile.name}.to_json
       end
     else
-      render :text => {:message => _('You are already a member of %s.') % profile.name}.to_json
+      render :text => {:message => _('You are already a member of %s.').html_safe % profile.name}.to_json
     end
   end
  
@@ -125,7 +135,7 @@ class ProfileController &lt; PublicController
         render :text => current_person.leave(profile, params[:reload])
       end
     else
-      render :text => {:message => _('You are not a member of %s.') % profile.name}.to_json
+      render :text => {:message => _('You are not a member of %s.').html_safe % profile.name}.to_json
     end
   end
  
@@ -145,12 +155,41 @@ class ProfileController &lt; PublicController
     # FIXME this shouldn't be in Person model?
     if !user.memberships.include?(profile)
       AddFriend.create!(:person => user, :friend => profile)
-      render :text => _('%s still needs to accept being your friend.') % profile.name
+      render :text => _('%s still needs to accept being your friend.').html_safe % profile.name
     else
-      render :text => _('You are already a friend of %s.') % profile.name
+      render :text => _('You are already a friend of %s.').html_safe % profile.name
+    end
+  end
+
+  def follow
+    if profile.followed_by?(current_person)
+      render :text => _("You are already following %s.") % profile.name, :status => 400
+    else
+      selected_circles = params[:circles].map{ |circle_name, circle_id| Circle.find_by(:id => circle_id) }.select{ |c| c.present? }
+      if selected_circles.present?
+        current_person.follow(profile, selected_circles)
+        render :text => _("You are now following %s") % profile.name, :status => 200
+      else
+        render :text => _("Select at least one circle to follow %s.") % profile.name, :status => 400
+      end
     end
   end
  
+  def find_profile_circles
+    circles = Circle.where(:person => current_person, :profile_type => profile.class.name)
+    render :partial => 'blocks/profile_info_actions/circles', :locals => { :circles => circles, :profile_types => Circle.profile_types.to_a }
+  end
+
+  def unfollow
+    follower = params[:follower_id].present? ? Person.find_by(id: params[:follower_id]) : current_person
+
+    if follower && follower.follows?(profile)
+      follower.unfollow(profile)
+    end
+    redirect_url = params["redirect_to"] ? params["redirect_to"] : profile.url
+    redirect_to redirect_url
+  end
+
   def check_friendship
     unless logged_in?
       render :text => ''
@@ -178,7 +217,7 @@ class ProfileController &lt; PublicController
   def unblock
     if current_user.person.is_admin?(profile.environment)
       profile.unblock
-      session[:notice] = _("You have unblocked %s successfully. ") % profile.name
+      session[:notice] = _("You have unblocked %s successfully. ").html_safe % profile.name
       redirect_to :controller => 'profile', :action => 'index'
     else
       message = _('You are not allowed to unblock enterprises in this environment.')
@@ -437,4 +476,8 @@ class ProfileController &lt; PublicController
     [:image, :domains, :preferred_domain, :environment]
   end
  
+  def allow_followers?
+    render_not_found unless profile.allow_followers?
+  end
+
 end
@@ -14,13 +14,23 @@ module ActionTrackerHelper
     }
   end
  
+  def new_follower_description ta
+    n_('has 1 new follower:<br />%{name}', 'has %{num} new followers:<br />%{name}', ta.get_follower_name.size).html_safe % {
+      num: ta.get_follower_name.size,
+      name: safe_join(ta.collect_group_with_index(:follower_name) do |n,i|
+        link_to image_tag(ta.get_follower_profile_custom_icon[i] || default_or_themed_icon("/images/icons-app/person-icon.png")),
+          ta.get_follower_url[i], title: n
+      end)
+    }
+  end
+
   def join_community_description ta
-    n_('has joined 1 community:<br />%{name}'.html_safe, 'has joined %{num} communities:<br />%{name}'.html_safe, ta.get_resource_name.size) % {
+    n_('has joined 1 community:<br />%{name}', 'has joined %{num} communities:<br />%{name}', ta.get_resource_name.size).html_safe % {
       num: ta.get_resource_name.size,
-      name: ta.collect_group_with_index(:resource_name) do |n,i|
+      name: safe_join(ta.collect_group_with_index(:resource_name) do |n,i|
        link = link_to image_tag(ta.get_resource_profile_custom_icon[i] || default_or_themed_icon("/images/icons-app/community-icon.png")),
                 ta.get_resource_url[i], title: n
-      end.join.html_safe
+      end)
     }
   end
  
@@ -68,9 +78,9 @@ module ActionTrackerHelper
   end
  
   def favorite_enterprise_description ta
-    _('favorited enterprise %{title}') % {
+    (_('favorited enterprise %{title}') % {
       title: link_to(truncate(ta.get_enterprise_name), ta.get_enterprise_url),
-    }
+    }).html_safe
   end
  
 end
@@ -880,7 +880,7 @@ module ApplicationHelper
         link_to_all = link_to(content_tag('strong', _('See all')), :controller => 'memberships', :profile => user.identifier)
       end
       link = list.map do |element|
-        link_to(content_tag('strong', _('<span>Manage</span> %s') % element.short_name(25)), element.admin_url, :class => "icon-menu-"+element.class.identification.underscore, :title => _('Manage %s') % element.short_name)
+        link_to(content_tag('strong', _('<span>Manage</span> %s').html_safe % element.short_name(25)), element.admin_url, :class => "icon-menu-"+element.class.identification.underscore, :title => _('Manage %s').html_safe % element.short_name)
       end
       if link_to_all
         link << link_to_all
@@ -921,7 +921,7 @@ module ApplicationHelper
     logout_link = link_to(logout_icon.html_safe, { :controller => 'account', :action => 'logout'} , :id => "logout", :title => _("Leave the system"))
     join_result = safe_join(
       [welcome_span.html_safe, render_environment_features(:usermenu).html_safe, admin_link.html_safe,
-        manage_enterprises.html_safe, manage_communities.html_safe, ctrl_panel_link.html_safe,
+        manage_enterprises, manage_communities, ctrl_panel_link.html_safe,
         pending_tasks_count.html_safe, logout_link.html_safe], "")
     join_result
   end
@@ -285,7 +285,7 @@ module BoxesHelper
     end
  
     if block.respond_to?(:help)
-      buttons << modal_inline_icon(:help, _('Help on this block'), {}, "#help-on-box-#{block.id}") << content_tag('div', content_tag('h2', _('Help')) + content_tag('div', block.help, :style => 'margin-bottom: 1em;') + modal_close_button(_('Close')), :style => 'display: none;', :id => "help-on-box-#{block.id}")
+      buttons << modal_inline_icon(:help, _('Help on this block'), {}, "#help-on-box-#{block.id}") << content_tag('div', content_tag('h2', _('Help')) + content_tag('div', block.help.html_safe, :style => 'margin-bottom: 1em;') + modal_close_button(_('Close')), :style => 'display: none;', :id => "help-on-box-#{block.id}")
     end
  
     if block.embedable?
@@ -128,14 +128,14 @@ module FormsHelper
       counter += 1
       row << item
       if counter % per_row == 0
-        rows << content_tag('tr', row.join("\n"))
+        rows << content_tag('tr', row.join("\n").html_safe)
         counter = 0
         row = []
       end
     end
-    rows << content_tag('tr', row.join("\n"))
+    rows << content_tag('tr', row.join("\n").html_safe)
  
-    content_tag('table',rows.join("\n"))
+    content_tag('table',rows.join("\n").html_safe)
   end
  
   def date_field(name, value, datepicker_options = {}, html_options = {})
@@ -11,7 +11,7 @@ module ProfileHelper
   PERSON_CATEGORIES[:location] = [:address, :address_reference, :zip_code, :city, :state, :district, :country, :nationality]
   PERSON_CATEGORIES[:work] = [:organization, :organization_website, :professional_activity]
   PERSON_CATEGORIES[:study] = [:schooling, :formation, :area_of_study]
-  PERSON_CATEGORIES[:network] = [:friends, :communities, :enterprises]
+  PERSON_CATEGORIES[:network] = [:friends, :followers, :followed_profiles, :communities, :enterprises]
   PERSON_CATEGORIES.merge!(COMMON_CATEGORIES)
  
   ORGANIZATION_CATEGORIES = {}
@@ -42,7 +42,8 @@ module ProfileHelper
     :created_at => _('Profile created at'),
     :members_count => _('Members'),
     :privacy_setting => _('Privacy setting'),
-    :article_tags => _('Tags')
+    :article_tags => _('Tags'),
+    :followed_profiles => _('Following')
   }
  
   EXCEPTION = {
@@ -144,6 +145,14 @@ module ProfileHelper
     link_to(n_('One picture', '%{num} pictures', gallery.images.published.count) % { :num => gallery.images.published.count }, gallery.url)
   end
  
+  def treat_followers(followers)
+    link_to(profile.followers.count, {:action=>"followed", :controller=>"profile", :profile=>"#{profile.identifier}"})
+  end
+
+  def treat_followed_profiles(followed_profiles)
+    link_to(profile.followed_profiles.count, {:action=>"following", :controller=>"profile", :profile=>"#{profile.identifier}"})
+  end
+
   def treat_events(events)
     link_to events.published.count, :controller => 'events', :action => 'events'
   end
@@ -19,8 +19,8 @@ class NotifyActivityToProfilesJob &lt; Struct.new(:tracked_action_id)
     # Notify the user
     ActionTrackerNotification.create(:profile_id => tracked_action.user.id, :action_tracker_id => tracked_action.id)
  
-    # Notify all friends
-    ActionTrackerNotification.connection.execute("insert into action_tracker_notifications(profile_id, action_tracker_id) select f.friend_id, #{tracked_action.id} from friendships as f where person_id=#{tracked_action.user.id} and f.friend_id not in (select atn.profile_id from action_tracker_notifications as atn where atn.action_tracker_id = #{tracked_action.id})")
+    # Notify all followers
+    ActionTrackerNotification.connection.execute("INSERT INTO action_tracker_notifications(profile_id, action_tracker_id) SELECT DISTINCT c.person_id, #{tracked_action.id} FROM profiles_circles AS p JOIN circles as c ON c.id = p.circle_id WHERE p.profile_id = #{tracked_action.user.id} AND (c.person_id NOT IN (SELECT atn.profile_id FROM action_tracker_notifications AS atn WHERE atn.action_tracker_id = #{tracked_action.id}))")
  
     if tracked_action.user.is_a? Organization
       ActionTrackerNotification.connection.execute "insert into action_tracker_notifications(profile_id, action_tracker_id) " +
@@ -47,8 +47,8 @@ class Contact
         content_type: 'text/html',
         to: contact.dest.notification_emails,
         reply_to: contact.email,
-        subject: "[#{contact.dest.short_name(30)}] " + contact.subject,
-        from: "#{contact.name} <#{contact.dest.environment.noreply_email}>"
+        subject: "[#{contact.dest.short_name(30)}] #{contact.subject}".html_safe,
+        from: "#{contact.name} <#{contact.dest.environment.noreply_email}>".html_safe
       }
  
       if contact.sender
@@ -30,7 +30,7 @@ class EnvironmentMailing &lt; Mailing
   end
  
   def signature_message
-    _('Sent by %s.') % source.name
+    _('Sent by %s.').html_safe % source.name
   end
  
   def url
@@ -2,7 +2,8 @@ require_dependency &#39;mailing_job&#39;
  
 class Mailing < ApplicationRecord
  
-  acts_as_having_settings :field => :data
+  extend ActsAsHavingSettings::ClassMethods
+  acts_as_having_settings field: :data
  
   attr_accessible :subject, :body, :data
  
@@ -23,11 +24,11 @@ class Mailing &lt; ApplicationRecord
   end
  
   def generate_from
-    "#{source.name} <#{if source.is_a? Environment then source.noreply_email else source.contact_email end}>"
+    "#{source.name} <#{if source.is_a? Environment then source.noreply_email else source.contact_email end}>".html_safe
   end
  
   def generate_subject
-    '[%s] %s' % [source.name, subject]
+    '[%s] %s'.html_safe % [source.name, subject]
   end
  
   def signature_message
@@ -30,7 +30,7 @@ class OrganizationMailing &lt; Mailing
   end
  
   def signature_message
-    _('Sent by community %s.') % source.name
+    _('Sent by community %s.').html_safe % source.name
   end
  
   include Rails.application.routes.url_helpers
@@ -12,8 +12,8 @@ class PendingTaskNotifier &lt; ApplicationMailer
  
     mail(
       to: person.email,
-      from: "#{person.environment.name} <#{person.environment.noreply_email}>",
-      subject: _("[%s] Pending tasks") % person.environment.name
+      from: "#{person.environment.name} <#{person.environment.noreply_email}>".html_safe,
+      subject: _("[%s] Pending tasks").html_safe % person.environment.name
     )
   end
  
@@ -14,8 +14,8 @@ class ScrapNotifier &lt; ApplicationMailer
     @url = sender.environment.top_url
     mail(
       to: receiver.email,
-      from: "#{sender.environment.name} <#{sender.environment.noreply_email}>",
-      subject: _("[%s] You received a scrap!") % [sender.environment.name]
+      from: "#{sender.environment.name} <#{sender.environment.noreply_email}>".html_safe,
+      subject: _("[%s] You received a scrap!").html_safe % [sender.environment.name]
     )
   end
 end
@@ -14,7 +14,7 @@ class TaskMailer &lt; ApplicationMailer
     mail(
       to: task.target.notification_emails.compact,
       from: self.class.generate_from(task),
-      subject: "[%s] %s" % [task.environment.name, task.target_notification_description]
+      subject: "[%s] %s".html_safe % [task.environment.name, task.target_notification_description]
     )
   end
  
@@ -27,7 +27,7 @@ class TaskMailer &lt; ApplicationMailer
     mail(
       to: task.friend_email,
       from: self.class.generate_from(task),
-      subject: '[%s] %s' % [ task.requestor.environment.name, task.target_notification_description ]
+      subject: '[%s] %s'.html_safe % [ task.requestor.environment.name, task.target_notification_description ]
     )
   end
  
@@ -43,7 +43,7 @@ class TaskMailer &lt; ApplicationMailer
     mail_with_template(
       to: task.requestor.notification_emails,
       from: self.class.generate_from(task),
-      subject: '[%s] %s' % [task.requestor.environment.name, task.target_notification_description],
+      subject: '[%s] %s'.html_safe % [task.requestor.environment.name, task.target_notification_description],
       email_template: task.email_template,
       template_params: {:environment => task.requestor.environment, :task => task, :message => @message, :url => @url, :requestor => task.requestor}
     )
@@ -13,8 +13,8 @@ class UserMailer &lt; ApplicationMailer
  
     mail(
       to: user_email,
-      from: "#{user.environment.name} <#{user.environment.contact_email}>",
-      subject: _("[%{environment}] Welcome to %{environment} mail!") % { :environment => user.environment.name }
+      from: "#{user.environment.name} <#{user.environment.contact_email}>".html_safe,
+      subject: _("[%{environment}] Welcome to %{environment} mail!").html_safe % { :environment => user.environment.name }
     )
   end
  
@@ -30,7 +30,7 @@ class UserMailer &lt; ApplicationMailer
     mail_with_template(
       from: "#{user.environment.name} <#{user.environment.contact_email}>",
       to: user.email,
-      subject: _("[%s] Activate your account") % [user.environment.name],
+      subject: _("[%s] Activate your account").html_safe % [user.environment.name],
       template_params: {:environment => user.environment, :activation_code => @activation_code, :redirection => @redirection, :join => @join, :person => user.person, :url => @url},
       email_template: user.environment.email_templates.find_by_template_type(:user_activation),
     )
@@ -44,8 +44,8 @@ class UserMailer &lt; ApplicationMailer
     mail(
       content_type: 'text/html',
       to: user.email,
-      from: "#{user.environment.name} <#{user.environment.contact_email}>",
-      subject: email_subject.blank? ? _("Welcome to environment %s") % [user.environment.name] : email_subject,
+      from: "#{user.environment.name} <#{user.environment.contact_email}>".html_safe,
+      subject: email_subject.blank? ? _("Welcome to environment %s").html_safe % [user.environment.name] : email_subject,
       body: @body
     )
   end
@@ -63,8 +63,8 @@ class UserMailer &lt; ApplicationMailer
     mail(
       content_type: 'text/html',
       to: user.email,
-      from: "#{user.environment.name} <#{user.environment.contact_email}>",
-      subject: _("[%s] What about grow up your network?") % user.environment.name
+      from: "#{user.environment.name} <#{user.environment.contact_email}>".html_safe,
+      subject: _("[%s] What about grow up your network?").html_safe % user.environment.name
     )
   end
  
@@ -25,7 +25,7 @@ class AbuseComplaint &lt; Task
   end
  
   def title
-    abuse_reports.count > 1 ? (_('Abuse complaint (%s)') % abuse_reports.count) :_('Abuse complaint')
+    abuse_reports.count > 1 ? (_('Abuse complaint (%s)').html_safe % abuse_reports.count) :_('Abuse complaint')
   end
  
   def linked_subject
@@ -57,15 +57,15 @@ class AbuseComplaint &lt; Task
   end
  
   def task_activated_message
-    _('Your profile was reported by the users of %s due to inappropriate behavior. The administrators of the environment are now reviewing the report. To solve this misunderstanding, please contact the administrators.') % environment.name
+    _('Your profile was reported by the users of %s due to inappropriate behavior. The administrators of the environment are now reviewing the report. To solve this misunderstanding, please contact the administrators.').html_safe % environment.name
   end
  
   def task_finished_message
-    _('Your profile was disabled by the administrators of %s due to inappropriate behavior. To solve this misunderstanding please contact them.') % environment.name
+    _('Your profile was disabled by the administrators of %s due to inappropriate behavior. To solve this misunderstanding please contact them.').html_safe % environment.name
   end
  
   def target_notification_description
-    _('%s was reported due to inappropriate behavior.') % reported.name
+    _('%s was reported due to inappropriate behavior.').html_safe % reported.name
   end
  
   def target_notification_message
@@ -22,6 +22,7 @@ class AddMember &lt; Task
       self.roles = [Profile::Roles.member(organization.environment.id).id]
     end
     target.affiliate(requestor, self.roles.select{|r| !r.to_i.zero? }.map{|i| Role.find(i)})
+    person.follow(organization, Circle.find_or_create_by(:person => person, :name =>_('memberships'), :profile_type => 'Community'))
   end
  
   def title
@@ -56,7 +57,7 @@ class AddMember &lt; Task
   def target_notification_description
     requestor_email = " (#{requestor.email})" if requestor.may_display_field_to?("email")
  
-    _("%{requestor}%{requestor_email} wants to be a member of '%{organization}'.") % {:requestor => requestor.name, :requestor_email => requestor_email, :organization => organization.name}
+    _("%{requestor}%{requestor_email} wants to be a member of '%{organization}'.").html_safe % {:requestor => requestor.name, :requestor_email => requestor_email, :organization => organization.name}
   end
  
   def target_notification_message
@@ -13,7 +13,9 @@ class Article &lt; ApplicationRecord
                   :image_builder, :show_to_followers, :archived,
                   :author, :display_preview, :published_at, :person_followers
  
+  extend ActsAsHavingImage::ClassMethods
   acts_as_having_image
+
   include Noosfero::Plugin::HotSpot
  
   SEARCHABLE_FIELDS = {
@@ -91,7 +93,8 @@ class Article &lt; ApplicationRecord
   has_many :article_categorizations_including_virtual, :class_name => 'ArticleCategorization'
   has_many :categories_including_virtual, :through => :article_categorizations_including_virtual, :source => :category
  
-  acts_as_having_settings :field => :setting
+  extend ActsAsHavingSettings::ClassMethods
...	...	@@ -54,6 +54,7 @@ module Api
54	54	mount V1::Blocks
55	55	mount V1::Profiles
56	56	mount V1::Activities
	57	+ mount V1::Roles
57	58
58	59	# hook point which allow plugins to add Grape::API extensions to Api::App
59	60	#finds for plugins which has api mount points classes defined (the class should extends Grape::API)
...	...
...	...	@@ -111,6 +111,10 @@ module Api
111	111	hash[value.custom_field.name]=value.value
112	112	end
113	113
	114	+ profile.public_fields.each do \|field\|
	115	+ hash[field] = profile.send(field.to_sym)
	116	+ end
	117	+
114	118	private_values = profile.custom_field_values - profile.public_values
115	119	private_values.each do \|value\|
116	120	if Entities.can_display_profile_field?(profile,options)
...	...	@@ -124,6 +128,7 @@ module Api
124	128	expose :type
125	129	expose :custom_header
126	130	expose :custom_footer
	131	+ expose :layout_template
127	132	expose :permissions do \|profile, options\|
128	133	Entities.permissions_for_entity(profile, options[:current_person],
129	134	:allow_post_content?, :allow_edit?, :allow_destroy?)
...	...	@@ -258,12 +263,28 @@ module Api
258	263	root 'tasks', 'task'
259	264	expose :id
260	265	expose :type
	266	+ expose :requestor, using: Profile
	267	+ expose :status
	268	+ expose :created_at
	269	+ expose :data
	270	+ expose :accept_details
	271	+ expose :reject_details
	272	+ expose :accept_disabled?, as: :accept_disabled
	273	+ expose :reject_disabled?, as: :reject_disabled
	274	+ expose :target do \|task, options\|
	275	+ type_map = {Profile => ::Profile, Environment => ::Environment}.find {\|h\| task.target.kind_of?(h.last)}
	276	+ type_map.first.represent(task.target) unless type_map.nil?
	277	+ end
261	278	end
262	279
263	280	class Environment < Entity
264	281	expose :name
265	282	expose :id
266	283	expose :description
	284	+ expose :layout_template
	285	+ expose :signup_intro
	286	+ expose :terms_of_use
	287	+ expose :top_url, as: :host
267	288	expose :settings, if: lambda { \|instance, options\| options[:is_admin] }
268	289	end
269	290
...	...	@@ -281,5 +302,12 @@ module Api
281	302	type_map.first.represent(activity.target) unless type_map.nil?
282	303	end
283	304	end
	305	+
	306	+ class Role < Entity
	307	+ root 'roles', 'role'
	308	+ expose :id
	309	+ expose :name
	310	+ expose :key
	311	+ end
284	312	end
285	313	end
...	...
...	...	@@ -4,7 +4,7 @@ require 'tempfile'
4	4	module Api
5	5	module Helpers
6	6	PRIVATE_TOKEN_PARAM = :private_token
7		- DEFAULT_ALLOWED_PARAMETERS = [:parent_id, :from, :until, :content_type, :author_id, :identifier, :archived]
	7	+ ALLOWED_PARAMETERS = [:parent_id, :from, :until, :content_type, :author_id, :identifier, :archived, :status]
8	8
9	9	include SanitizeParams
10	10	include Noosfero::Plugin::HotSpot
...	...	@@ -124,8 +124,8 @@ module Api
124	124	present_partial article, with: Entities::Article, params: params, current_person: current_person
125	125	end
126	126
127		- def present_articles_for_asset(asset, method = 'articles')
128		- articles = find_articles(asset, method)
	127	+ def present_articles_for_asset(asset, method_or_relation = 'articles')
	128	+ articles = find_articles(asset, method_or_relation)
129	129	present_articles(articles)
130	130	end
131	131
...	...	@@ -133,8 +133,8 @@ module Api
133	133	present_partial paginate(articles), :with => Entities::Article, :params => params, current_person: current_person
134	134	end
135	135
136		- def find_articles(asset, method = 'articles')
137		- articles = select_filtered_collection_of(asset, method, params)
	136	+ def find_articles(asset, method_or_relation = 'articles')
	137	+ articles = select_filtered_collection_of(asset, method_or_relation, params)
138	138	if current_person.present?
139	139	articles = articles.display_filter(current_person, nil)
140	140	else
...	...	@@ -143,14 +143,17 @@ module Api
143	143	articles
144	144	end
145	145
146		- def find_task(asset, id)
147		- task = asset.tasks.find(id)
	146	+ def find_task(asset, method_or_relation, id)
	147	+ task = is_a_relation?(method_or_relation) ? method_or_relation : asset.send(method_or_relation)
	148	+ task = task.find_by_id(id)
	149	+ not_found! if task.blank?
148	150	current_person.has_permission?(task.permission, asset) ? task : forbidden!
149	151	end
150	152
151	153	def post_task(asset, params)
152	154	klass_type= params[:content_type].nil? ? 'Task' : params[:content_type]
153	155	return forbidden! unless klass_type.constantize <= Task
	156	+ return forbidden! if !current_person.has_permission?(:perform_task, asset)
154	157
155	158	task = klass_type.constantize.new(params[:task])
156	159	task.requestor_id = current_person.id
...	...	@@ -163,15 +166,24 @@ module Api
163	166	present_partial task, :with => Entities::Task
164	167	end
165	168
166		- def present_task(asset)
167		- task = find_task(asset, params[:id])
	169	+ def find_tasks(asset, method_or_relation = 'tasks')
	170	+ return forbidden! if !current_person.has_permission?(:perform_task, asset)
	171	+ tasks = select_filtered_collection_of(asset, method_or_relation, params)
	172	+ tasks = tasks.select {\|t\| current_person.has_permission?(t.permission, asset)}
	173	+ tasks
	174	+ end
	175	+
	176	+ def present_task(asset, method_or_relation = 'tasks')
	177	+ task = find_task(asset, method_or_relation, params[:id])
168	178	present_partial task, :with => Entities::Task
169	179	end
170	180
171		- def present_tasks(asset)
172		- tasks = select_filtered_collection_of(asset, 'tasks', params)
173		- tasks = tasks.select {\|t\| current_person.has_permission?(t.permission, asset)}
174		- return forbidden! if tasks.empty? && !current_person.has_permission?(:perform_task, asset)
	181	+ def present_tasks_for_asset(asset, method_or_relation = 'tasks')
	182	+ tasks = find_tasks(asset, method_or_relation)
	183	+ present_tasks(tasks)
	184	+ end
	185	+
	186	+ def present_tasks(tasks)
175	187	present_partial tasks, :with => Entities::Task
176	188	end
177	189
...	...	@@ -180,7 +192,6 @@ module Api
180	192	conditions = {}
181	193	from_date = DateTime.parse(parsed_params.delete(:from)) if parsed_params[:from]
182	194	until_date = DateTime.parse(parsed_params.delete(:until)) if parsed_params[:until]
183		-
184	195	conditions[:type] = parse_content_type(parsed_params.delete(:content_type)) unless parsed_params[:content_type].nil?
185	196
186	197	conditions[:created_at] = period(from_date, until_date) if from_date \|\| until_date
...	...	@@ -190,7 +201,7 @@ module Api
190	201	end
191	202
192	203	# changing make_order_with_parameters to avoid sql injection
193		- def make_order_with_parameters(object, method, params)
	204	+ def make_order_with_parameters(object, method_or_relation, params)
194	205	order = "created_at DESC"
195	206	unless params[:order].blank?
196	207	if params[:order].include? '\'' or params[:order].include? '"'
...	...	@@ -199,9 +210,9 @@ module Api
199	210	order = 'RANDOM()'
200	211	else
201	212	field_name, direction = params[:order].split(' ')
202		- assoc = object.class.reflect_on_association(method.to_sym)
203		- if !field_name.blank? and assoc
204		- if assoc.klass.attribute_names.include? field_name
	213	+ assoc_class = extract_associated_classname(method_or_relation)
	214	+ if !field_name.blank? and assoc_class
	215	+ if assoc_class.attribute_names.include? field_name
205	216	if direction.present? and ['ASC','DESC'].include? direction.upcase
206	217	order = "#{field_name} #{direction.upcase}"
207	218	end
...	...	@@ -212,12 +223,14 @@ module Api
212	223	return order
213	224	end
214	225
215		- def make_timestamp_with_parameters_and_method(params, method)
	226	+ def make_timestamp_with_parameters_and_method(params, method_or_relation)
216	227	timestamp = nil
217	228	if params[:timestamp]
218	229	datetime = DateTime.parse(params[:timestamp])
219		- table_name = method.to_s.singularize.camelize.constantize.table_name
220		- timestamp = "#{table_name}.updated_at >= '#{datetime}'"
	230	+ table_name = extract_associated_tablename(method_or_relation)
	231	+ assoc_class = extract_associated_classname(method_or_relation)
	232	+ date_atrr = assoc_class.attribute_names.include?('updated_at') ? 'updated_at' : 'created_at'
	233	+ timestamp = "#{table_name}.#{date_atrr} >= '#{datetime}'"
221	234	end
222	235
223	236	timestamp
...	...	@@ -242,12 +255,12 @@ module Api
242	255	end
243	256	end
244	257
245		- def select_filtered_collection_of(object, method, params)
	258	+ def select_filtered_collection_of(object, method_or_relation, params)
246	259	conditions = make_conditions_with_parameter(params)
247		- order = make_order_with_parameters(object,method,params)
248		- timestamp = make_timestamp_with_parameters_and_method(params, method)
	260	+ order = make_order_with_parameters(object,method_or_relation,params)
	261	+ timestamp = make_timestamp_with_parameters_and_method(params, method_or_relation)
249	262
250		- objects = object.send(method)
	263	+ objects = is_a_relation?(method_or_relation) ? method_or_relation : object.send(method_or_relation)
251	264	objects = by_reference(objects, params)
252	265	objects = by_categories(objects, params)
253	266
...	...	@@ -302,12 +315,12 @@ module Api
302	315	end
303	316
304	317	def cant_be_saved_request!(attribute)
305		- message = _("(Invalid request) %s can't be saved") % attribute
	318	+ message = _("(Invalid request) %s can't be saved").html_safe % attribute
306	319	render_api_error!(message, 400)
307	320	end
308	321
309	322	def bad_request!(attribute)
310		- message = _("(Invalid request) %s not given") % attribute
	323	+ message = _("(Invalid request) %s not given").html_safe % attribute
311	324	render_api_error!(message, 400)
312	325	end
313	326
...	...	@@ -393,10 +406,27 @@ module Api
393	406	end
394	407	private
395	408
	409	+ def extract_associated_tablename(method_or_relation)
	410	+ extract_associated_classname(method_or_relation).table_name
	411	+ end
	412	+
	413	+ def extract_associated_classname(method_or_relation)
	414	+ if is_a_relation?(method_or_relation)
	415	+ method_or_relation.blank? ? '' : method_or_relation.first.class
	416	+ else
	417	+ method_or_relation.to_s.singularize.camelize.constantize
	418	+ end
	419	+ end
	420	+
	421	+ def is_a_relation?(method_or_relation)
	422	+ method_or_relation.kind_of?(ActiveRecord::Relation)
	423	+ end
	424	+
	425	+
396	426	def parser_params(params)
397	427	parsed_params = {}
398	428	params.map do \|k,v\|
399		- parsed_params[k.to_sym] = v if DEFAULT_ALLOWED_PARAMETERS.include?(k.to_sym)
	429	+ parsed_params[k.to_sym] = v if ALLOWED_PARAMETERS.include?(k.to_sym)
400	430	end
401	431	parsed_params
402	432	end
...	...
...	...	@@ -119,6 +119,20 @@ module Api
119	119	members = select_filtered_collection_of(profile, 'members', params)
120	120	present members, :with => Entities::Person, :current_person => current_person
121	121	end
	122	+
	123	+ post do
	124	+ authenticate!
	125	+ profile = environment.profiles.find_by id: params[:profile_id]
	126	+ profile.add_member(current_person) rescue forbidden!
	127	+ {pending: !current_person.is_member_of?(profile)}
	128	+ end
	129	+
	130	+ delete do
	131	+ authenticate!
	132	+ profile = environment.profiles.find_by id: params[:profile_id]
	133	+ profile.remove_member(current_person)
	134	+ present current_person, :with => Entities::Person, :current_person => current_person
	135	+ end
122	136	end
123	137	end
124	138	end
...	...
...	...	@@ -0,0 +1,25 @@
	1	+module Api
	2	+ module V1
	3	+ class Roles < Grape::API
	4	+ before { authenticate! }
	5	+
	6	+ MAX_PER_PAGE = 50
	7	+
	8	+ resource :profiles do
	9	+ segment "/:profile_id" do
	10	+ resource :roles do
	11	+
	12	+ paginate max_per_page: MAX_PER_PAGE
	13	+ get do
	14	+ profile = environment.profiles.find(params[:profile_id])
	15	+ return forbidden! unless profile.kind_of?(Organization)
	16	+ roles = Profile::Roles.organization_roles(profile.environment.id, profile.id)
	17	+ present_partial paginate(roles), with: Entities::Role
	18	+ end
	19	+
	20	+ end
	21	+ end
	22	+ end
	23	+ end
	24	+ end
	25	+end
...	...
1	1	module Api
2	2	module V1
3	3	class Tasks < Grape::API
4		-# before { authenticate! }
	4	+ before { authenticate! }
5	5
6		-# ARTICLE_TYPES = Article.descendants.map{\|a\| a.to_s}
	6	+ MAX_PER_PAGE = 50
7	7
8	8	resource :tasks do
9	9
10		- # Collect tasks
	10	+ paginate max_per_page: MAX_PER_PAGE
	11	+ # Collect all tasks that current person has permission
11	12	#
12	13	# Parameters:
13	14	# from - date where the search will begin. If nothing is passed the default date will be the date of the first article created
...	...	@@ -17,15 +18,27 @@ module Api
17	18	# Example Request:
18	19	# GET host/api/v1/tasks?from=2013-04-04-14:41:43&until=2015-04-04-14:41:43&limit=10&private_token=e96fff37c2238fdab074d1dcea8e6317
19	20	get do
20		- tasks = select_filtered_collection_of(environment, 'tasks', params)
21		- tasks = tasks.select {\|t\| current_person.has_permission?(t.permission, environment)}
22		- present_partial tasks, :with => Entities::Task
	21	+ tasks = Task.to(current_person)
	22	+ present_tasks_for_asset(current_person, tasks)
23	23	end
24	24
25	25	desc "Return the task id"
26	26	get ':id' do
27		- task = find_task(environment, params[:id])
28		- present_partial task, :with => Entities::Task
	27	+ present_task(current_person, Task.to(current_person))
	28	+ end
	29	+
	30	+ %w[finish cancel].each do \|action\|
	31	+ desc "#{action.capitalize} a task"
	32	+ put ":id/#{action}" do
	33	+ task = find_task(current_person, Task.to(current_person), params[:id])
	34	+ begin
	35	+ task.update(params[:task])
	36	+ task.send(action, current_person) if (task.status == Task::Status::ACTIVE)
	37	+ present_partial task, :with => Entities::Task
	38	+ rescue Exception => ex
	39	+ render_api_error!(ex.message, 500)
	40	+ end
	41	+ end
29	42	end
30	43	end
31	44
...	...	@@ -36,7 +49,8 @@ module Api
36	49	resource :tasks do
37	50	get do
38	51	profile = environment.send(kind.pluralize).find(params["#{kind}_id"])
39		- present_tasks(profile)
	52	+ tasks = Task.to(profile)
	53	+ present_tasks_for_asset(profile, tasks)
40	54	end
41	55
42	56	get ':id' do
...	...
...	...	@@ -44,7 +44,7 @@ class CategoriesController < AdminController
44	44	if request.post?
45	45	@category.update!(params[:category])
46	46	@saved = true
47		- session[:notice] = _("Category %s saved." % @category.name)
	47	+ session[:notice] = _("Category %s saved." % @category.name).html_safe
48	48	redirect_to :action => 'index'
49	49	end
50	50	rescue Exception => e
...	...
...	...	@@ -14,6 +14,20 @@ class ApplicationController < ActionController::Base
14	14	before_filter :redirect_to_current_user
15	15
16	16	before_filter :set_session_theme
	17	+
	18	+ # FIXME: only include necessary methods
	19	+ include ApplicationHelper
	20	+
	21	+ # concerns
	22	+ include PermissionCheck
	23	+ include CustomDesign
	24	+ include NeedsProfile
	25	+
	26	+ # implementations
	27	+ include FindByContents
	28	+ include Noosfero::Plugin::HotSpot
	29	+ include SearchTermHelper
	30	+
17	31	def set_session_theme
18	32	if params[:theme]
19	33	session[:theme] = environment.theme_ids.include?(params[:theme]) ? params[:theme] : nil
...	...	@@ -48,7 +62,6 @@ class ApplicationController < ActionController::Base
48	62	end
49	63	end
50	64
51		- include ApplicationHelper
52	65	layout :get_layout
53	66	def get_layout
54	67	return false if request.format == :js or request.xhr?
...	...	@@ -74,9 +87,6 @@ class ApplicationController < ActionController::Base
74	87	helper :document
75	88	helper :language
76	89
77		- include DesignHelper
78		- include PermissionCheck
79		-
80	90	before_filter :set_locale
81	91	def set_locale
82	92	FastGettext.available_locales = environment.available_locales
...	...	@@ -89,8 +99,6 @@ class ApplicationController < ActionController::Base
89	99	end
90	100	end
91	101
92		- include NeedsProfile
93		-
94	102	attr_reader :environment
95	103
96	104	# declares that the given <tt>actions</tt> cannot be accessed by other HTTP
...	...	@@ -107,6 +115,10 @@ class ApplicationController < ActionController::Base
107	115
108	116	protected
109	117
	118	+ def accept_only_post
	119	+ return render_not_found if !request.post?
	120	+ end
	121	+
110	122	def verified_request?
111	123	super \|\| form_authenticity_token == request.headers['X-XSRF-TOKEN']
112	124	end
...	...	@@ -151,8 +163,6 @@ class ApplicationController < ActionController::Base
151	163	end
152	164	end
153	165
154		- include Noosfero::Plugin::HotSpot
155		-
156	166	# FIXME this filter just loads @plugins to children controllers and helpers
157	167	def init_noosfero_plugins
158	168	plugins
...	...	@@ -184,9 +194,6 @@ class ApplicationController < ActionController::Base
184	194	end
185	195	end
186	196
187		- include SearchTermHelper
188		- include FindByContents
189		-
190	197	def find_suggestions(query, context, asset, options={})
191	198	plugins.dispatch_first(:find_suggestions, query, context, asset, options)
192	199	end
...	...
...	...	@@ -109,7 +109,7 @@ class BoxOrganizerController < ApplicationController
109	109	def show_block_type_info
110	110	type = params[:type]
111	111	if type.blank? \|\| !available_blocks.map(&:name).include?(type)
112		- raise ArgumentError.new("Type %s is not allowed. Go away." % type)
	112	+ raise ArgumentError.new("Type %s is not allowed. Go away.".html_safe % type)
113	113	end
114	114	@block = type.constantize.new
115	115	@block.box = Box.new(:owner => boxes_holder)
...	...	@@ -122,7 +122,7 @@ class BoxOrganizerController < ApplicationController
122	122
123	123	def new_block(type, box)
124	124	if !available_blocks.map(&:name).include?(type)
125		- raise ArgumentError.new("Type %s is not allowed. Go away." % type)
	125	+ raise ArgumentError.new("Type %s is not allowed. Go away.".html_safe % type)
126	126	end
127	127	block = type.constantize.new
128	128	box.blocks << block
...	...
...	...	@@ -0,0 +1,169 @@
	1	+module AuthenticatedSystem
	2	+
	3	+ protected
	4	+
	5	+ extend ActiveSupport::Concern
	6	+
	7	+ included do
	8	+ if self < ActionController::Base
	9	+ around_filter :user_set_current
	10	+ before_filter :override_user
	11	+ before_filter :login_from_cookie
	12	+ end
	13	+
	14	+ # Inclusion hook to make #current_user and #logged_in?
	15	+ # available as ActionView helper methods.
	16	+ helper_method :current_user, :logged_in?
	17	+ end
	18	+
	19	+ # Returns true or false if the user is logged in.
	20	+ # Preloads @current_user with the user model if they're logged in.
	21	+ def logged_in?
	22	+ current_user != nil
	23	+ end
	24	+
	25	+ # Accesses the current user from the session.
	26	+ def current_user user_id = session[:user]
	27	+ @current_user \|\|= begin
	28	+ user = User.find_by id: user_id if user_id
	29	+ user.session = session if user
	30	+ User.current = user
	31	+ user
	32	+ end
	33	+ end
	34	+
	35	+ # Store the given user in the session.
	36	+ def current_user=(new_user)
	37	+ if new_user.nil?
	38	+ session.delete(:user)
	39	+ else
	40	+ session[:user] = new_user.id
	41	+ new_user.session = session
	42	+ new_user.register_login
	43	+ end
	44	+ @current_user = User.current = new_user
	45	+ end
	46	+
	47	+ # See impl. from http://stackoverflow.com/a/2513456/670229
	48	+ def user_set_current
	49	+ User.current = current_user
	50	+ yield
	51	+ ensure
	52	+ # to address the thread variable leak issues in Puma/Thin webserver
	53	+ User.current = nil
	54	+ end
	55	+
	56	+ # Check if the user is authorized.
	57	+ #
	58	+ # Override this method in your controllers if you want to restrict access
	59	+ # to only a few actions or if you want to check if the user
	60	+ # has the correct rights.
	61	+ #
	62	+ # Example:
	63	+ #
	64	+ # # only allow nonbobs
	65	+ # def authorize?
	66	+ # current_user.login != "bob"
	67	+ # end
	68	+ def authorized?
	69	+ true
	70	+ end
	71	+
	72	+ # Filter method to enforce a login requirement.
	73	+ #
	74	+ # To require logins for all actions, use this in your controllers:
	75	+ #
	76	+ # before_filter :login_required
	77	+ #
	78	+ # To require logins for specific actions, use this in your controllers:
	79	+ #
	80	+ # before_filter :login_required, :only => [ :edit, :update ]
	81	+ #
	82	+ # To skip this in a subclassed controller:
	83	+ #
	84	+ # skip_before_filter :login_required
	85	+ #
	86	+ def login_required
	87	+ username, passwd = get_auth_data
	88	+ if username && passwd
	89	+ self.current_user \|\|= User.authenticate(username, passwd) \|\| nil
	90	+ end
	91	+ if logged_in? && authorized?
	92	+ true
	93	+ else
	94	+ if params[:require_login_popup]
	95	+ render :json => { :require_login_popup => true }
	96	+ else
	97	+ access_denied
	98	+ end
	99	+ end
	100	+ end
	101	+
	102	+ # Redirect as appropriate when an access request fails.
	103	+ #
	104	+ # The default action is to redirect to the login screen.
	105	+ #
	106	+ # Override this method in your controllers if you want to have special
	107	+ # behavior in case the user is not authorized
	108	+ # to access the requested action. For example, a popup window might
	109	+ # simply close itself.
	110	+ def access_denied
	111	+ respond_to do \|accepts\|
	112	+ accepts.html do
	113	+ if request.xhr?
	114	+ render :text => _('Access denied'), :status => 401
	115	+ else
	116	+ store_location
	117	+ redirect_to :controller => '/account', :action => 'login'
	118	+ end
	119	+ end
	120	+ accepts.xml do
	121	+ headers["Status"] = "Unauthorized"
	122	+ headers["WWW-Authenticate"] = %(Basic realm="Web Password")
	123	+ render :text => "Could't authenticate you", :status => '401 Unauthorized'
	124	+ end
	125	+ end
	126	+ false
	127	+ end
	128	+
	129	+ # Store the URI of the current request in the session.
	130	+ #
	131	+ # We can return to this location by calling #redirect_back_or_default.
	132	+ def store_location(location = request.url)
	133	+ session[:return_to] = location
	134	+ end
	135	+
	136	+ # Redirect to the URI stored by the most recent store_location call or
	137	+ # to the passed default.
	138	+ def redirect_back_or_default(default)
	139	+ if session[:return_to]
	140	+ redirect_to(session.delete(:return_to))
	141	+ else
	142	+ redirect_to(default)
	143	+ end
	144	+ end
	145	+
	146	+ def override_user
	147	+ return if params[:override_user].blank?
	148	+ return unless logged_in? and user.is_admin? environment
	149	+ @current_user = nil
	150	+ current_user params[:override_user]
	151	+ end
	152	+
	153	+ # When called with before_filter :login_from_cookie will check for an :auth_token
	154	+ # cookie and log the user back in if apropriate
	155	+ def login_from_cookie
	156	+ return if cookies[:auth_token].blank? or logged_in?
	157	+ user = User.where(remember_token: cookies[:auth_token]).first
	158	+ self.current_user = user if user and user.remember_token?
	159	+ end
	160	+
	161	+ private
	162	+ @@http_auth_headers = %w(X-HTTP_AUTHORIZATION HTTP_AUTHORIZATION Authorization)
	163	+ # gets BASIC auth info
	164	+ def get_auth_data
	165	+ auth_key = @@http_auth_headers.detect { \|h\| request.env.has_key?(h) }
	166	+ auth_data = request.env[auth_key].to_s.split unless auth_key.blank?
	167	+ return auth_data && auth_data[0] == 'Basic' ? Base64.decode64(auth_data[1]).split(':')[0..1] : [nil, nil]
	168	+ end
	169	+end
...	...