Handle json requests for hidden info requests.

2 files changed, 51 insertions, 19 deletions

diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index b8ccdf926..a455d1725 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -67,8 +67,7 @@ class RequestController < ApplicationController
 
             # Test for whole request being hidden
             if !@info_request.user_can_view?(authenticated_user)
-                render :template => 'request/hidden', :status => 410 # gone
-                return
+                return render_hidden
             end
 
             # Other parameters
@@ -126,8 +125,7 @@ class RequestController < ApplicationController
         long_cache
         @info_request = InfoRequest.find_by_url_title!(params[:url_title])
         if !@info_request.user_can_view?(authenticated_user)
-            render :template => 'request/hidden', :status => 410 # gone
-            return
+            return render_hidden
         end
         @columns = ['id', 'event_type', 'created_at', 'described_state', 'last_described_at', 'calculated_state' ]
     end
@@ -146,8 +144,7 @@ class RequestController < ApplicationController
         raise ActiveRecord::RecordNotFound.new("Request not found") if @info_request.nil?
 
         if !@info_request.user_can_view?(authenticated_user)
-            render :template => 'request/hidden', :status => 410 # gone
-            return
+            return render_hidden
         end
         @xapian_object = ::ActsAsXapian::Similar.new([InfoRequestEvent], @info_request.info_request_events,
             :offset => (@page - 1) * @per_page, :limit => @per_page, :collapse_by_prefix => 'request_collapse')
@@ -587,8 +584,7 @@ class RequestController < ApplicationController
 
         # Test for hidden requests
         if !authenticated_user.nil? && !@info_request.user_can_view?(authenticated_user)
-            render :template => 'request/hidden', :status => 410 # gone
-            return
+            return render_hidden
         end
 
         # Check address is good
@@ -671,7 +667,7 @@ class RequestController < ApplicationController
         raise ActiveRecord::RecordNotFound.new("Message not found") if incoming_message.nil?
         if !incoming_message.info_request.user_can_view?(authenticated_user)
             @info_request = incoming_message.info_request # used by view
-            render :template => 'request/hidden', :status => 410 # gone
+            return render_hidden
         end
         # Is this a completely public request that we can cache attachments for
         # to be served up without authentication?
@@ -711,7 +707,7 @@ class RequestController < ApplicationController
                 logger.info("Reading cache for #{key_path}")
 
                 if File.directory?(key_path)
-                    render :text => "Directory listing not allowed", :status => 403 
+                    render :text => "Directory listing not allowed", :status => 403
                 else
                     render :text => foi_fragment_cache_read(key_path),
                         :content_type => (AlaveteliFileTypes.filename_to_mimetype(params[:file_name]) || 'application/octet-stream')
@@ -882,8 +878,7 @@ class RequestController < ApplicationController
             @info_request = InfoRequest.find_by_url_title!(params[:url_title])
             # Test for whole request being hidden or requester-only
             if !@info_request.all_can_view?
-                render :template => 'request/hidden', :status => 410 # gone
-                return
+                return render_hidden
             end
             if authenticated?(
                               :web => _("To download the zip file"),
@@ -943,5 +938,17 @@ class RequestController < ApplicationController
             end
         end
     end
+
+    private
+
+    def render_hidden
+        respond_to do |format|
+            response_code = 410 # gone
+            format.html{ render :template => 'request/hidden', :status => response_code }
+            format.any{ render :nothing => true, :status => response_code }
+        end
+        false
+    end
+
 end
 
diff --git a/spec/controllers/request_controller_spec.rb b/spec/controllers/request_controller_spec.rb
index 9cc60a103..83e2b1767 100644
--- a/spec/controllers/request_controller_spec.rb
+++ b/spec/controllers/request_controller_spec.rb
@@ -816,6 +816,16 @@ describe RequestController, "when changing prominence of a request" do
         response.should render_template('hidden')
     end
 
+    it 'should not show hidden requests if requested using json' do
+        ir = info_requests(:fancy_dog_request)
+        ir.prominence = 'hidden'
+        ir.save!
+
+        session[:user_id] = ir.user.id # bob_smith_user
+        get :show, :url_title => 'why_do_you_have_such_a_fancy_dog', :format => 'json'
+        response.code.should == '410'
+    end
+
     it "should show hidden requests if logged in as super user" do
         ir = info_requests(:fancy_dog_request)
         ir.prominence = 'hidden'
@@ -1236,14 +1246,29 @@ describe RequestController, "when viewing an individual response for reply/follo
         response.body.should have_selector("div#other_recipients ul li", :content => "Frob")
     end
 
-    it "should not show individual responses if request hidden, even if request owner" do
-        ir = info_requests(:fancy_dog_request)
-        ir.prominence = 'hidden'
-        ir.save!
+    context 'when a request is hidden' do
+
+        before do
+            ir = info_requests(:fancy_dog_request)
+            ir.prominence = 'hidden'
+            ir.save!
+
+            session[:user_id] = users(:bob_smith_user).id
+        end
+
+        it "should not show individual responses, even if request owner" do
+            get :show_response, :id => info_requests(:fancy_dog_request).id, :incoming_message_id => incoming_messages(:useless_incoming_message)
+            response.should render_template('request/hidden')
+        end
+
+        it 'should respond to a json request for a hidden request with a 410 code and no body' do
+            get :show_response, :id => info_requests(:fancy_dog_request).id,
+                                :incoming_message_id => incoming_messages(:useless_incoming_message),
+                                :format => 'json'
+
+            response.code.should == '410'
+        end
 
-        session[:user_id] = users(:bob_smith_user).id
-        get :show_response, :id => info_requests(:fancy_dog_request).id, :incoming_message_id => incoming_messages(:useless_incoming_message)
-        response.should render_template('request/hidden')
     end
 
     describe 'when viewing a response for an external request' do